Notifications
Clear all
Topic starter
30/10/2008 5:42 am
Hello,
I have a system that I have pulled the Windows logs (Application, System, Security) to analyse. The Application and System logs are intact, but the security logs are empty. I have searched unallocated space for the security.evt file header, another searchable item commonly found in the file and there were no hits. Is the Security.evt logging turned on by default? Any other thoughts?
Thanks,
30/10/2008 9:50 am
Windows Security logging is turned off by default. You can look through the registry for policy settings to confirm, but the empty Security Event log is no surprise.
30/10/2008 4:10 pm
Check out RegRipper (RegRipper.net)…there is a plugin you can run against the Security hive file and get the audit policy for the box….