Logon,logoff,locking in the event log - Revision history

Michael.mast at 15:31, 26 June 2019

2019-06-26T15:31:56Z

Michael.mast at 15:31, 26 June 2019

2019-06-26T15:31:20Z

Michael.mast at 15:38, 15 February 2018

2018-02-15T15:38:11Z

Michael.mast at 17:13, 9 February 2018

2018-02-09T17:13:01Z

Michael.mast at 22:34, 8 February 2018

2018-02-08T22:34:20Z

Michael.mast: /* Notes */

2018-02-07T15:40:35Z

Notes

Michael.mast: /* Replacement Strings */

2018-02-06T20:40:59Z

Replacement Strings

Michael.mast: /* EventIDs */

2018-02-06T20:40:27Z

EventIDs

Michael.mast: /* EventIDs */

2018-02-06T20:36:11Z

EventIDs

Michael.mast at 20:35, 6 February 2018

2018-02-06T20:35:42Z

@@ Line 1: / Line 1: @@
 ==Purpose==
 To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.
 ===Collector and Forwarding===

← Older revision		Revision as of 15:31, 26 June 2019
Line 2:		Line 2:
	To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.		To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.

−	~~==Enabling Printer Auditing via GPO==~~
−	~~It appears that to enable print logging, using the built in logging function, you have to edit the registry to~~
−	~~#Enable the log<ref>https://social.technet.microsoft.com/Forums/windowsserver/en-US/8e7399f6-ffdc-48d6-927b-f0beebd4c7f0/enabling-print-history-through-group-policy?forum=winserverprint</ref>~~
−	~~#Tell the system the log exists.<ref>https://support.netaphor.com/index.php?/article/AA-00574/0/Enabling-Print-Logging-on-Windows-Server-2008-R2-and-Newer-Print-Servers.html</ref>~~
−	~~<br>~~
−	~~<br>~~
−	~~The following edits and additions are needed~~
−	~~#Update the following to 1 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\WINEVT\Channels \Microsoft-Windows-PrintService/Operational, entry Enabled)~~
−	~~#Create the following key (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Microsoft-Windows-PrintService/Operational)~~
−	~~<br>~~
−	~~<br>~~
−	Windows comes with an operational entry in event viewer for the Microsoft-Windows-PrintService event sub directory. However it gets overwritten with whatever you put into the key that you create. Not sure how it associates the key to print services since every other application has an operational entry, and the location of the key does not seem to corresponding to a particular service.
−	~~<br>~~
−	~~<ref>https://blogs.technet.microsoft.com/askperf/2008/08/12/two-minute-drill-enabling-print-queue-logging/</ref>~~

	==Moving Event Log Location==		==Moving Event Log Location==

@@ Line 17: / Line 17: @@
 <ref>https://blogs.technet.microsoft.com/askperf/2008/08/12/two-minute-drill-enabling-print-queue-logging/</ref>
-==Notes==
+==Moving Event Log Location==
 ===Collector and Forwarding===
 Initial attempt is made using a DC as the collector as it already had spare storage.
@@ Line 24: / Line 27: @@
 *You do need to enable WinRM on the collector, in this case I am using a DC which already had it configured.
 *For machines that will forward security events, make sure the "Network Service" user account is added to the "Evcent Log Readers" security group.<ref>https://social.technet.microsoft.com/Forums/sharepoint/en-US/8434ffb3-1621-4bc5-8311-66d88b215886/how-to-collect-security-logs-using-event-forwarding?forum=winservergen</ref>
 ===EventIDs===

@@ Line 23: / Line 23: @@
 *Make sure that if you change the directory in which you store the forwarded log file, that permissions are set to allow full control to both the Local Service and Network Service accounts.
 *You do need to enable WinRM on the collector, in this case I am using a DC which already had it configured.
+*For machines that will forward security events, make sure the "Network Service" user account is added to the "Evcent Log Readers" security group.<ref>https://social.technet.microsoft.com/Forums/sharepoint/en-US/8434ffb3-1621-4bc5-8311-66d88b215886/how-to-collect-security-logs-using-event-forwarding?forum=winservergen</ref>
 ===EventIDs===

@@ Line 1: / Line 1: @@
 ==Purpose==
 To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.
 ==Notes==
 ===Collector and Forwarding===
@@ Line 29: / Line 45: @@
 *10 : RemoteInteractive - A user logged on to this computer remotely using Terminal Services or Remote Desktop.
 *11 : CachedInteractive - A user logged on to this computer with network credentials that were stored locally on the computer.
 ===Replacement Strings===

@@ Line 10: / Line 10: @@
 ===EventIDs===
 *4624 : All logon types
 *4634 : An account was logged off.<ref>https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4634</ref>