I'm trying to analyze the logs of my 2 servers, one Win 2k8 R2 and the other Win 2k3. Specifically, I would like to be able to see in the logs if a user deleted, accessed, or modified either the Security Event or System Event logs. I found this link that has an event code for when a log is cleared, and was wondering if there was some way to see if a log was accessed through Event Viewer. I haven't been able to find a code for simply accessing these logs through Event Viewer. And as far as I am aware, a user should not be able to modify the contents of this two log files other than clearing them, correct? Just to be clear, I want to know if a user is in Event Viewer and looking through these audit logs.

  • I'm not sure (hence not posting this as an answer), but I believe you'd have to enable file system auditing and monitor those logs for access to the event log files/folder. This link gives you a basic how-to on auditing file access... it's for file servers, but the same principles apply, and I'm sure it's every bit as much of a pain in the ass to do what you want. – HopelessN00b Oct 30 '14 at 17:34
  • Thanks for bringing that up. I'm just wondering if monitoring the .evtx file will just show that some system account is accessing it rather than a user account since the viewing is being done through Event Viewer. – Kevin Qiu Oct 30 '14 at 17:59
  • You'll get the user account accessing it. Would kind of defeat the whole purpose of having permissions on files if you could sidestep them by using a different application, wouldn't it? – HopelessN00b Oct 30 '14 at 18:04
  • I see. I'll see if setting up log file monitoring works then. – Kevin Qiu Oct 30 '14 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.