Member Avatar for bossie09

If audit log is turn off on the windows server, can i use a software to generate & view the log files. If yes please suggest the tool.

Regards,

  • 2 Contributors
  • 3 Replies
  • 349 Views
  • 57 Minutes Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Short answer for : there is no tool that can retroactively “create” native Windows Security audit events for activity that occurred while auditing was turned off. As pointed out, if the OS didn’t record those audit events at the time, you won’t suddenly find them in the Security log.

What you can do is twofold. For retrospective reconstruction, hunt for alternative evidence that may show the same activity: application logs (IIS, SQL, etc.), antivirus/EDR logs, firewall/proxy and backup logs, and on-disk forensic artifacts (MFT entries, Prefetch, ShimCache/AppCompatCache, LNK files, shellbags, registry UserAssist, pagefile or memory dumps). These sources won’t produce official Security-audit records but often reveal process starts, file accesses, and network connections. If formal evidence is required, preserve the disk image first and use forensic tools or a specialist.

For future protection, enable and centralize auditing before an incident. Use Advanced Audit Policy (via Group Policy or auditpol), deploy richer host telemetry such as Sysmon (Sysinternals), forward logs to a SIEM/collector, and increase Security log size/retention so events aren’t overwritten. Quick check of current audit settings:

auditpol /get /category:*

Caution: installing an agent now will only capture events from install time forward — it cannot reconstruct past events. If investigation or legal preservation is needed, avoid further writes to the system and consider engaging a forensic professional.

Recommended Answers

All 3 Replies

Member Avatar for JorgeM

If auditing is disabled in the local policy, then there would not be any entries in the security event log.

Member Avatar for bossie09

I know that, but im wondering if there is any tool on the market which can provide me with the log details. For eg: if i install a particular software on the server it could produce the events that took place when auditing was disable

Member Avatar for JorgeM

Ok, to clarify, in the Windows Event Audit logs, you have the Application, System, and Security event logs, as well as some other Windows Services such as DNS will have their own as well.

When it comes to applications, events related to the application can be written to the Application log. However, that is a function of hte application. its not built into Windows. Some applications write to their own logs, while others choose to write the Windows application log.

Auditing is ONLY required for security related events, not system or application logs.

Windows comes with its built-in viewer. Its called the Event viewer. You can access it from your Administrative tools. it allows you to search and view each item in detail.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.