0

Windows domain.

Problem is in audit feature. I know how to enable audit in Group policy, but there is problem. One of our domain admins has killed host computer with hyper-v and we don't know who it were. Logon logs group policy standard, were on this computer and now destroyed.

As I suggest current problem is unsolvable, but for the future we need some sort of tools for it.

My first idea were power shell or PHP script which start on user logon and do insert in SQL, but if user login on other computer and from there will do \\computer\c$ and kill there everything than script will not run.

Is there in windows or 3rd party software some sort of instrument which stores logs from computer to another place, rsyslog i.e or copies current computer logs to some server excluded from domain with only local users on it?

Any good practices appreciated. Thank you.

0

Windows Event Forwarding will meet basic needs.

https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.