A colleague and I have been discussing an IS audit demo on Windows.
One point we'd like to cover is that an administrative/high-privilege user should view the security log within X hours of a failure event. Something as follows
- Read the ID of a failure event
- Apply a filter on the privilege use by an admin/privy user constrained to the ID of the failure event/security event log
Basically I'd like to know whether it is possible to verify when the security log was last viewed, and by whom. Can this be done?