New answers tagged


While Windows allows filtering, you cannot divert certain events based on ID to a different log. It is to some extent possible to divert certain event sources to their own event log (e.g. you can create a specific log for a software product and redirect its events to that log), but the security log is pretty much immutable. If this is really bothersome to ...


This is a very interesting topic, as a few years back i had a similar issue with a large corporation that has data centers across the world, most of its data was company oriented and was on private networks. But to the topic at hand, most large networks that require both, network engineers and network administrators. Network engineers and network ...


Set applocker in audit mode, run the install and the eventlog will show you what would have been blocked.


I believe it is auditctl -a never,user -F subj_type=crond_t It works except for the 'type=LOGIN' Then: auditctl always,exclude -F msgtype=LOGIN -F subj_type=crond_t and you're good to go

Top 50 recent answers are included