Which Windows historically has not really
provided us really any great mechanisms for centralized logging.
It typically requires a SIS Log client or
third party utility for compatibility with SIS Log servers or SIMs.
With Windows, it does have some root
logging mechanisms, but historically, they haven't followed the same standards or
protocols that you've seen in other OSes like Linux.
Windows logs.
Log lots of stuff.
Os tracks various events, activities, and functions through logs.
Windows Event Logs consists of a header and a series of event records.
Standards have to provide a way for
applications to record important software and hard drive events.
Again, you're going to be playing with Windows event logs in the lab.
The registry key configuration for where
the Windows audit log configurations take place.
Everything is configured in the Windows registry, so we're not going to spend a
whole lot of time with the individual registry keys.
But the Windows event log types and entries, Event Viewer is the native
Windows utility that is used for analyzing or viewing log files.
There are three primary log files.
You've got the application, the system, and security.
There's other log files depending on the
job role of the system, set up logs, things like that.
But this is one of the first places you're going to look for security issues.
So you've got your...
And again, you're going to be playing with the VEB Viewer in the lab.
It gives you all sorts of information, different event types.
You have errors, you have warnings, you
have information, you have success and failure audits.
For most of the log types, an information is, Hey, something happened.
A warning is, Hey, something happened.
An error is, Hey, something happened.
Different levels of severity.
Error means something failed, a significant problem.
A warning is something is potentially going to fail.
An information can be something like just the successful starting of a service.
Success audits and failure audits are used to record when you've got an audit policy
in place, audit successful object access or failed object access.
Those typically show up in your security log.
Again, application,
security, and system are the three primary log files in Windows.
You have different levels or event types.
Then under Event Viewer, you have event IDs and
all sorts of information regarding the event.
With Event Viewer, you have the log name.
Let's bring one up here.
Out of the gates, application security and System.
Setup is the set up, use it to troubleshoot network setups.
There's forward events, which is again a
mechanism for forwarding from one system to another.
But under the system, it's system related events.
Again, we got lots of information here, but I've got an error.
I take a look at the error.
That error, the driver version of the disk does not match.
Then the details, which is in an XML view
or user friendly view, the log file is recorded in an XML format.
Then you've got a bunch of information under general,
the log name, the source, the event ID, the level, the user, the op code, when it
was logged, task category keywords, all sorts of criteria to filter by, which
again, you're going to be playing with this in the lab.
The security log is in your audit successes and failures.
So for example, I've got an event ID 4672.
A special privilege was assigned to new login.
There's the details.
So the security log is the odd man out.
You have audit successes and failures.
Everything else has information, errors, and warnings.
All right, filtering or finding events in Event Viewer.
So you can filter that log file
by all sorts of criteria, event level, logs, source, IDs, keywords, etc.
Very robust searching.
And of course, you can filter and search in third party utilities as well.
That's what third party utilities do.
System Log entries.
The system log contains events that logged by Windows system components.
Changes the OS hardware configuration, device driver installations, software
hardware installations, starting a topic of service, etc.
The application log is written for applications to report to it, but you will
see some Microsoft services right to the application log.
You will see some SQL Server messages, things like that, that are not necessarily
part of the operating system, but installed Microsoft application.
So applications for applications, system for OS specific, and again, security for
security entries, results of audit policies, that thing.
Monitoring and analysis.
Windows logs, the security logger, the mother of all logs in forensics terms.
Log ons, Log offs, and temp and connection since all this is security specific.
Unfortunately, security logging is turned off by default, at least most of it.
The Windows audit policy is configured to
turn this stuff on and you will be enabling policies in the labs.
You should turn on things like account
management, account log ons, audit log ons, and so forth.