2

Someone or something recently disabled UAC on a critical server and it is now asking for a reboot (which can not happen). Is there an event in the logs that will tell me which account disabled this? And can I re-enable it without rebooting to get rid of the 'reboot' prompt?

Thanks.

Improve this question
2
  • Not an answer but... Are you sure about granting admin privileges to lots of people? Unexperienced admins can cause a lot more damage on critical (you said that) servers
    – usr-local-ΕΨΗΕΛΩΝ
    Nov 27, 2012 at 11:57
  • That's a good point. I shouldn't have said critical, as it's not production but it is a shared terminal server in the production environment. By critical I meant, critical that it not be rebooted since it's always in use by many other developers.
    – eth0
    Nov 27, 2012 at 20:01

1 Answer 1

Reset to default
3

Privilege Elevation yields a logon event, so look after the last occurrences of Event ID 4648 (interactive logon) and 4624 (successful logon attempt) in the Security Log.

Otherwise, change the UAC policy back and check what events are generated in the event log - then search for similar events

Update: If you have large volumes of event log entries to search through, have a go with EventCombMT and search for the above mentioned events. It is a bit old school, but very useful for gathering and sorting event log entries on one or more Windows machines

Improve this answer
7
  • +1 Also, System Log: Event 104 - XXX log file was cleared in case they had half a brain.
    – Chris S
    Nov 27, 2012 at 0:48
  • And Security Log event id 1102
    – Mathias R. Jessen
    Nov 27, 2012 at 0:49
  • The problem is, I have about a dozen users RDP's into this box at once. So I also have a couple dozen security events per minute, it looks like. Even if I knew what time this took place, it would be quite difficult to figure out.
    – eth0
    Nov 27, 2012 at 1:47
  • So, basically everybody that is logged into this machine currently match the event ID's I found, which are triggered in the Security event log by changing the UAC; found by testing with my own account. I probably should have mentioned this is a terminal server. Does this make it impossible to find the information I am looking for?
    – eth0
    Nov 27, 2012 at 4:27
  • When you say "disabled UAC", are you referring to changing the settings and policies guarding UAC, or per-user UAC options?
    – Mathias R. Jessen
    Nov 27, 2012 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .