Windows Event Viewer
A Windows event log is one of the first tools to use to learn to analyze problems. As a security administrator, you must ensure that local logging is enabled on systems and networking devices. The process that can create an audit log is usually required to run in privileged mode so that users cannot stop or change it. To view logs on a Windows asset through a graphic user interface (GUI) like you see in Figure 9.1, you have to open the Event Viewer.
Figure 9.1: Windows Event Viewer displaying logs
Events are placed into three different categories, each of which is related to a log that Windows keeps. While there are a lot of categories, the majority of troubleshooting and investigation happens in the application, system, or security log.
- Application The application log records events related to Windows components like drivers.
- System The system log records events about programs installed.
- Security When security logging is enabled, this log records events related...
