Problem is in audit feature. I know how to enable audit in
Group policy, but there is problem. One of our
domain admins has killed host computer with hyper-v and we don't know who it were. Logon logs
group policy standard, were on this computer and now destroyed.
As I suggest current problem is unsolvable, but for the future we need some sort of tools for it.
My first idea were
power shell or
PHP script which start on user logon and do insert in SQL, but if user login on other computer and from there will do
\\computer\c$ and kill there everything than script will not run.
Is there in
windows or 3rd party software some sort of instrument which stores logs from computer to another place,
rsyslog i.e or copies current computer logs to some server excluded from domain with only local users on it?
good practices appreciated. Thank you.