Solved

Can a Windows 2003 Server Event Log File be changed

Posted on 2010-08-24
4
499 Views
Last Modified: 2013-12-04
We are trying to find out what or who activated a service process on a server and a key log file entry is missing. I recreated the event on a test sever by starting the service and it generates an event log with my name on it. Can the .evt file be opened and changed then replaced.
0
Comment
Question by:brent4257
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 3

Accepted Solution

by:
superggg earned 500 total points
ID: 33511842
Yes
To do this you must disable the event log service from running at boot
reboot, then edit the file (un-attribing it, then using notepad or Word.) Then re-enable the event log service and reboot again.
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511855
The log files are located
Windows\System32\config
 
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511965
Also a handy little utility
http://www.ntsecurity.nu/toolbox/winzapper/
 
 
0
 
LVL 1

Author Comment

by:brent4257
ID: 33512164
Ok I suspected it could be done now the question is how to prevent this from happening. Thanks
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as the high-speed power of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question