Windows Security · 2.6
📋 Audit Logs & Event Viewer
Reading the system's black box⏱ ~3 min
✈️Event logs are the plane's black box
Aircraft black boxes record every sensor reading so investigators can reconstruct what happened after a crash. Event Viewer records every login attempt, service start/stop, policy change, and system error — so you (or a forensic investigator) can reconstruct what happened after a breach.
Opening Event Viewer: eventvwr.msc
Log Types to Know
| Log | What It Records | Competition Use |
|---|---|---|
| Security | Login attempts (success & failure), privilege use, account changes | Most important — check for unauthorized logins |
| System | OS events, driver failures, service start/stop | Find malicious services that started automatically |
| Application | Events from installed programs | Check for crash logs or unauthorized software activity |
| Setup | Windows Update and installation events | Confirm updates were installed |
Configuring Audit Policy
By default, Windows logs very little. You must enable Audit Policy to capture security events. Go to: secpol.msc → Local Policies → Audit Policy
| Audit Setting | Recommend |
|---|---|
| Audit account logon events | Success, Failure |
| Audit account management | Success, Failure |
| Audit logon events | Success, Failure |
| Audit object access | Failure |
| Audit policy change | Success |
| Audit privilege use | Failure |
| Audit system events | Success, Failure |
💡 TipEnabling audit logging in competition often earns points AND gives you visibility into what's happening on the system — a double benefit.
Reading Security Logs
- •Event ID 4624 — Successful login; note the account name and logon type
- •Event ID 4625 — Failed login; repeated failures = brute-force attempt
- •Event ID 4720 — User account created
- •Event ID 4732 — User added to Administrators group
- •Event ID 4698 — Scheduled task created (often used by malware for persistence)
🧠Quick Checkfirst try = +5 XP
Where do you find failed login attempts on Windows?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days