Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Can a Windows 2003 Server Event Log File be changed

Posted on 2010-08-24
4
Medium Priority
?
501 Views
Last Modified: 2013-12-04
We are trying to find out what or who activated a service process on a server and a key log file entry is missing. I recreated the event on a test sever by starting the service and it generates an event log with my name on it. Can the .evt file be opened and changed then replaced.
0
Comment
Question by:brent4257
  • 3
4 Comments
 
LVL 3

Accepted Solution

by:
superggg earned 2000 total points
ID: 33511842
Yes
To do this you must disable the event log service from running at boot
reboot, then edit the file (un-attribing it, then using notepad or Word.) Then re-enable the event log service and reboot again.
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511855
The log files are located
Windows\System32\config
 
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511965
Also a handy little utility
http://www.ntsecurity.nu/toolbox/winzapper/
 
 
0
 
LVL 1

Author Comment

by:brent4257
ID: 33512164
Ok I suspected it could be done now the question is how to prevent this from happening. Thanks
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…

782 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question