?
Solved

Event Viewer Deletion Time

Posted on 2011-05-06
2
Medium Priority
?
251 Views
Last Modified: 2012-06-27
Hi,

 I currently have a windows 2003 server and one day I needed to see who accesed it at a certain time but the logs appeared to have been deleted by someone. How do I see who deleted them or at least the time of deletion?

Regards!
0
Comment
Question by:parsero
1 Comment
 
LVL 10

Accepted Solution

by:
Thorrsson earned 2000 total points
ID: 35710606
Slideshare on receovering Event log info
http://www.slideshare.net/ctin/recovering-information-from-deleted-security-event-logs-ctin

Here is a screenshot of the entry found after  clearing the log on a 2008 R2 box
 EVT Example
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Learn about cloud computing and its benefits for small business owners.
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question