Sign in
Windows Security Logging and Other Esoterica
thoughts from the Windows auditing team
Options
Email Blog Author
RSS for posts
Atom
RSS for comments
OK
Search Blogs
Tags
ACS
Descriptions
HowTo
Laws
Malware
News
Previews
Privacy
Rants
SEM
Tips
Tools
Unicode
Archive
Archives
June 2012
(1)
August 2011
(1)
May 2011
(1)
April 2011
(1)
July 2010
(1)
May 2010
(1)
August 2009
(1)
June 2009
(1)
September 2008
(1)
August 2008
(1)
July 2008
(4)
April 2008
(2)
March 2008
(1)
February 2008
(3)
January 2008
(1)
November 2007
(1)
October 2007
(2)
August 2007
(5)
July 2007
(3)
June 2007
(2)
May 2007
(3)
April 2007
(1)
February 2007
(3)
October 2006
(1)
September 2006
(2)
August 2006
(2)
June 2006
(1)
May 2006
(2)
March 2006
(3)
December 2005
(6)
November 2005
(2)
September 2005
(3)
August 2005
(11)
January 2005
(1)
December 2004
(2)
October 2004
(1)
July, 2008
MSDN Blogs
>
Windows Security Logging and Other Esoterica
>
July, 2008
Posts
Subscribe via RSS
Sort by:
Most Recent
|
Most Views
|
Most Comments
Excerpt View
|
Full Post View
Windows Security Logging and Other Esoterica
WEvtUtil Scripting
Posted
over 5 years ago
by
Eric Fitzgerald
4
Comments
If you haven't used wevtutil.exe to script event log tasks in Windows Vista or Windows Server 2008, you're missing out. The new tool makes getting events out of the log pretty easy, but the main thing is that it doesn't suffer from any of the drawbacks...
Windows Security Logging and Other Esoterica
If you're gonna herd bots, do it from New Zealand!
Posted
over 5 years ago
by
Eric Fitzgerald
0
Comments
A judge in New Zealand declined to convict the admitted (guilty plea) botherder of a million-bot botnet, citing the negative consequences a conviction would have on the young man's future prospects. See the story here . Well duh. The whole theory of...
Windows Security Logging and Other Esoterica
ACS' first bug from being too performant
Posted
over 5 years ago
by
Eric Fitzgerald
0
Comments
We got several reports recently of a bug in ACS that certain DS Access events, primarily for dnsNode and dnsZone objects, don't properly get looked up. Some background: the event log in Windows prefers to log invariants such as message IDs, parameter...
Windows Security Logging and Other Esoterica
ACS Event Retention Mechanism
Posted
over 5 years ago
by
Eric Fitzgerald
0
Comments
I get a lot of questions about how ACS event retention works. So here you go, I'm blogging it so I can just answer with a link :-) There are two DWORD registry values which affect backlog transmission. Both are on the collector machine under HKLM\System...
Page 1 of 1 (4 items)