0

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their integrity?

1
  • Send it to Syslog or SIEM
    – Infra
    Jul 22, 2021 at 9:59

1 Answer 1

1

A centralized logging server like a SIEM which has regular backups would be a great place to start. This would also allow you to more easily analyze these logs for anomalies versus reading the raw event logs. There are a variety of open source solutions that cost no money that can perform this task.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .