Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Windows Server 2003 - Shutdown Reason / "Whodunnit" after logs have been cleared

Posted on 2014-12-16
2
192 Views
Last Modified: 2014-12-30
Hello,

I have a Windows 2003 server that has been rebooted outside of our normal authorization schedule, and I need to figure out who did the rebooting.

The thing is, whomever did it cleared the SYSTEM LOG and SECURITY LOG.  The APP LOG and other logs are still intact.  This server is a terminal server that is accessible by all users, but only admins are allowed to reboot...and all admins are denying that they did this, so we are trying to get to the bottom of WHO did this.  

I do know exactly what time this happened, so if there are any other logs that I might check to see WHO logged in or the last person that was logged in when the server was rebooted, that would be great.  The one surviving log (APPLOG) does not have anything that would let us know which user was logged in or who performed the reboot.

Help is appreciated, thanks!
0
Comment
Question by:jkeegan123
2 Comments
 
LVL 6

Accepted Solution

by:
Rob G earned 500 total points
ID: 40503497
All of your logs should be located here:

%SystemRoot%\System32\Config

Typically you will have duplicates that will last 24hours after the removal of the logs from the event viewer.. Unless they went into that directory, you should have some form of logs left there..

You should have both...
.evt which are likely gone..
and .LOG1 or LOG2 files that should still be there. .
If you get yourself Notepad++ you should be able to open them, they should contain the info you are looking for..

Otherwise..
Why not just check all the admin's security logs?
They should tell you when the system was rebooted based on who was logged into it at the time.. Those logs should still exist on the client..

You could also look at the logs on the switch, assuming you have logging turned on..
Another place to check..

Windowsupdate.log
Sometimes it will show you who did the rebooting in there..
0
 
LVL 3

Expert Comment

by:v_2abhis2
ID: 40503713
If the logs was cleared in windows 2003  an event ID 517  gets generated in the Audit logs

Example:

The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ACME
Client Logon ID: (0x0,0x3F5C9)

And I windows 2008 event ID 1102 gets generated

The audit log was cleared.
Subject:
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question