Hey everybody and welcome to the next video.
We're going to be talking about clearing windows logs more specifically Windows event logs.
Now if we take a look at the windows logs here we're getting into your Unger application we've got quite
a few different things.
Error for MSA installers which was if you have been looking at previous videos.
This is where we exploited and MSA installer for always install.
So you can see there's quite a bit of information here going to system get a few errors service control
managers DCP and nothing important in security at the moment so to clear windows event logs you need
a return to session that has is running as anti system authority.
But before we actually clear it I want to note something for you guys in Windows it has been designed
to not let you clear individual aspects of the log now Metis point.
We can we can manipulate the logs in event viewer.
However currently all it has is to clear them completely.
So you're only real option of clear windows logs is to blow them all out.
Now you could modify that code potentially to only removes bits and pieces.
I haven't personally tested it out but it's possible.
But in this case we're not going to go that far we're just gonna be blowing out the logs completely
now.
And then when you're getting into a return here it is run clear logs.
That's it.
So it's going to just go through and try to bust out all the clearing logs.
Can't find clear logs.
So it's clear EDI will go ahead and run that instead clear logs was the old command so here.
So it looks like it failed for the system log or for the since it open so it looks like it wiped 51
records from application one eighty five from system.
So let's do a quick refresh here.
All right.
Perfect.
And the reason it failed is because on security there was no there wasn't anything for it to clear so
it failed.
So but you can see here we've cleared the logs.
Now there is nothing but anything past this point that we generate plus we'll add be added to the new
logs.
But you can go ahead and clear them this way.
It is fairly obvious on Windows machines to administrators however.
Keep in mind that a lot of times admins won't even bother to pour out the windows of that logs.
So they are normally just on the system until something occurs then they go ahead and look at the logs.
So you're you're not going to be finding some log rotation tool or log forwarding off of a Windows machine
that often.
However there are other log locations that you could actually modify.
Just as simple as text files and that's for like the guess server and the FCP server and a few other
things on a Windows server but not on the desktop.
And keep in mind that even though just like Linux that we have custom binaries custom scripts running
that create their own log files it's entirely possible that Windows has these as well.
So it's always worth this double checking and looking around the file system.
If you're planning on wiping any logs.