Solved

Windows Server 2003 - Shutdown Reason / "Whodunnit" after logs have been cleared

Posted on 2014-12-16
2
197 Views
Last Modified: 2014-12-30
Hello,

I have a Windows 2003 server that has been rebooted outside of our normal authorization schedule, and I need to figure out who did the rebooting.

The thing is, whomever did it cleared the SYSTEM LOG and SECURITY LOG.  The APP LOG and other logs are still intact.  This server is a terminal server that is accessible by all users, but only admins are allowed to reboot...and all admins are denying that they did this, so we are trying to get to the bottom of WHO did this.  

I do know exactly what time this happened, so if there are any other logs that I might check to see WHO logged in or the last person that was logged in when the server was rebooted, that would be great.  The one surviving log (APPLOG) does not have anything that would let us know which user was logged in or who performed the reboot.

Help is appreciated, thanks!
0
Comment
Question by:jkeegan123
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
Rob G earned 500 total points
ID: 40503497
All of your logs should be located here:

%SystemRoot%\System32\Config

Typically you will have duplicates that will last 24hours after the removal of the logs from the event viewer.. Unless they went into that directory, you should have some form of logs left there..

You should have both...
.evt which are likely gone..
and .LOG1 or LOG2 files that should still be there. .
If you get yourself Notepad++ you should be able to open them, they should contain the info you are looking for..

Otherwise..
Why not just check all the admin's security logs?
They should tell you when the system was rebooted based on who was logged into it at the time.. Those logs should still exist on the client..

You could also look at the logs on the switch, assuming you have logging turned on..
Another place to check..

Windowsupdate.log
Sometimes it will show you who did the rebooting in there..
0
 
LVL 3

Expert Comment

by:v_2abhis2
ID: 40503713
If the logs was cleared in windows 2003  an event ID 517  gets generated in the Audit logs

Example:

The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ACME
Client Logon ID: (0x0,0x3F5C9)

And I windows 2008 event ID 1102 gets generated

The audit log was cleared.
Subject:
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question