We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't know what to search for to determine how and who made the change.

I can't find a corresponding vendor message ID on the MS website. Would Windows log this change somewhere else that I can search through? The logging wasn't cleared, just disabled.

I used VMID 7040 for service being disabled but wasn't able to get any hits. So I don't think it was disabled that route. Not sure how else it could have been disabled. Maybe a registry edit?

  • Is your administrators local to servers or they are part of an Active Directory (AD) environment? – Sayan Oct 11 '18 at 0:05
  • They're all joined on the domain. From what I can tell, a GPO was pushed out by someone since they were all turned off at the same time. – shelum Oct 11 '18 at 0:42
  • Could you clarify what you meant by "I can't find a corresponding vendor message ID on the MS website"? Are you saying you couldn't find a system log event ID related to disabling logging? Also, which service specifically was disabled? – Daisetsu Oct 11 '18 at 3:09
  • 1
    If you still suspect it was done through a group policy, logs are located at Applications and Services Logs/Microsoft/Windows/GroupPolicy in the Event Viewer. Also, do your administrators have their own admin accounts or are they using a shared account (for example ''Administrator'')? – Zwans Oct 11 '18 at 6:59
  • Thanks @Zwans that was helpful. I was able to use VMID 4907 for audit policy changed to help determine what happened. – shelum Oct 11 '18 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.