Solved

Windows Server 2003 - Shutdown Reason / "Whodunnit" after logs have been cleared

Posted on 2014-12-16
2
184 Views
Last Modified: 2014-12-30
Hello,

I have a Windows 2003 server that has been rebooted outside of our normal authorization schedule, and I need to figure out who did the rebooting.

The thing is, whomever did it cleared the SYSTEM LOG and SECURITY LOG.  The APP LOG and other logs are still intact.  This server is a terminal server that is accessible by all users, but only admins are allowed to reboot...and all admins are denying that they did this, so we are trying to get to the bottom of WHO did this.  

I do know exactly what time this happened, so if there are any other logs that I might check to see WHO logged in or the last person that was logged in when the server was rebooted, that would be great.  The one surviving log (APPLOG) does not have anything that would let us know which user was logged in or who performed the reboot.

Help is appreciated, thanks!
0
Comment
Question by:jkeegan123
2 Comments
 
LVL 6

Accepted Solution

by:
Rob G earned 500 total points
Comment Utility
All of your logs should be located here:

%SystemRoot%\System32\Config

Typically you will have duplicates that will last 24hours after the removal of the logs from the event viewer.. Unless they went into that directory, you should have some form of logs left there..

You should have both...
.evt which are likely gone..
and .LOG1 or LOG2 files that should still be there. .
If you get yourself Notepad++ you should be able to open them, they should contain the info you are looking for..

Otherwise..
Why not just check all the admin's security logs?
They should tell you when the system was rebooted based on who was logged into it at the time.. Those logs should still exist on the client..

You could also look at the logs on the switch, assuming you have logging turned on..
Another place to check..

Windowsupdate.log
Sometimes it will show you who did the rebooting in there..
0
 
LVL 3

Expert Comment

by:v_2abhis2
Comment Utility
If the logs was cleared in windows 2003  an event ID 517  gets generated in the Audit logs

Example:

The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ACME
Client Logon ID: (0x0,0x3F5C9)

And I windows 2008 event ID 1102 gets generated

The audit log was cleared.
Subject:
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now