We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't know what to search for to determine how and who made the change.
I can't find a corresponding vendor message ID on the MS website. Would Windows log this change somewhere else that I can search through? The logging wasn't cleared, just disabled.
I used VMID 7040 for service being disabled but wasn't able to get any hits. So I don't think it was disabled that route. Not sure how else it could have been disabled. Maybe a registry edit?