Solved

Windows Server 2003 - Shutdown Reason / "Whodunnit" after logs have been cleared

Posted on 2014-12-16
2
189 Views
Last Modified: 2014-12-30
Hello,

I have a Windows 2003 server that has been rebooted outside of our normal authorization schedule, and I need to figure out who did the rebooting.

The thing is, whomever did it cleared the SYSTEM LOG and SECURITY LOG.  The APP LOG and other logs are still intact.  This server is a terminal server that is accessible by all users, but only admins are allowed to reboot...and all admins are denying that they did this, so we are trying to get to the bottom of WHO did this.  

I do know exactly what time this happened, so if there are any other logs that I might check to see WHO logged in or the last person that was logged in when the server was rebooted, that would be great.  The one surviving log (APPLOG) does not have anything that would let us know which user was logged in or who performed the reboot.

Help is appreciated, thanks!
0
Comment
Question by:jkeegan123
2 Comments
 
LVL 6

Accepted Solution

by:
Rob G earned 500 total points
ID: 40503497
All of your logs should be located here:

%SystemRoot%\System32\Config

Typically you will have duplicates that will last 24hours after the removal of the logs from the event viewer.. Unless they went into that directory, you should have some form of logs left there..

You should have both...
.evt which are likely gone..
and .LOG1 or LOG2 files that should still be there. .
If you get yourself Notepad++ you should be able to open them, they should contain the info you are looking for..

Otherwise..
Why not just check all the admin's security logs?
They should tell you when the system was rebooted based on who was logged into it at the time.. Those logs should still exist on the client..

You could also look at the logs on the switch, assuming you have logging turned on..
Another place to check..

Windowsupdate.log
Sometimes it will show you who did the rebooting in there..
0
 
LVL 3

Expert Comment

by:v_2abhis2
ID: 40503713
If the logs was cleared in windows 2003  an event ID 517  gets generated in the Audit logs

Example:

The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ACME
Client Logon ID: (0x0,0x3F5C9)

And I windows 2008 event ID 1102 gets generated

The audit log was cleared.
Subject:
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now