Solved

Windows Server 2003 - Shutdown Reason / "Whodunnit" after logs have been cleared

Posted on 2014-12-16
2
204 Views
Last Modified: 2014-12-30
Hello,

I have a Windows 2003 server that has been rebooted outside of our normal authorization schedule, and I need to figure out who did the rebooting.

The thing is, whomever did it cleared the SYSTEM LOG and SECURITY LOG.  The APP LOG and other logs are still intact.  This server is a terminal server that is accessible by all users, but only admins are allowed to reboot...and all admins are denying that they did this, so we are trying to get to the bottom of WHO did this.  

I do know exactly what time this happened, so if there are any other logs that I might check to see WHO logged in or the last person that was logged in when the server was rebooted, that would be great.  The one surviving log (APPLOG) does not have anything that would let us know which user was logged in or who performed the reboot.

Help is appreciated, thanks!
0
Comment
Question by:jkeegan123
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
Rob G earned 500 total points
ID: 40503497
All of your logs should be located here:

%SystemRoot%\System32\Config

Typically you will have duplicates that will last 24hours after the removal of the logs from the event viewer.. Unless they went into that directory, you should have some form of logs left there..

You should have both...
.evt which are likely gone..
and .LOG1 or LOG2 files that should still be there. .
If you get yourself Notepad++ you should be able to open them, they should contain the info you are looking for..

Otherwise..
Why not just check all the admin's security logs?
They should tell you when the system was rebooted based on who was logged into it at the time.. Those logs should still exist on the client..

You could also look at the logs on the switch, assuming you have logging turned on..
Another place to check..

Windowsupdate.log
Sometimes it will show you who did the rebooting in there..
0
 
LVL 3

Expert Comment

by:v_2abhis2
ID: 40503713
If the logs was cleared in windows 2003  an event ID 517  gets generated in the Audit logs

Example:

The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ACME
Client Logon ID: (0x0,0x3F5C9)

And I windows 2008 event ID 1102 gets generated

The audit log was cleared.
Subject:
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9
0

Featured Post

Increase Agility with Enabled Toolchains

Connect your existing build, deployment, management, monitoring, and collaboration platforms. From Puppet to Chef, HipChat to Slack, ServiceNow to JIRA, Splunk to New Relic and beyond, hand off data between systems to engage the right people.

Connect with xMatters.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Learn about cloud computing and its benefits for small business owners.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question