Tagged Questions
1
vote
1answer
185 views
Silent (no user interaction) utility to clear cached credentials on Windows [closed]
Is there any way to clear cached credentials on Windows, that doesn't require:
user interaction (e.g. a confirmation window);
administrator access; or
making a persistent change to the ...
7
votes
1answer
119 views
Why would it be preferable for a system to shut down when the security log is full?
When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
6
votes
4answers
217 views
Finding date of last network access
I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
4
votes
1answer
1k views
What's the risk of changing permissions of the Security Eventlog registry key to IT operations?
Background
Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:
...
0
votes
2answers
263 views
Logging and Metrics for DEP, EMET, and Related Mitigations
Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
3
votes
1answer
526 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
3
votes
1answer
133 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
3
votes
2answers
521 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
3
votes
2answers
290 views
Setup and record outbound traffic from a botnet in a sandbox/secure environment
How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.
I need to setup some kind of an experiment where I ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
