Windows Security Logging and Other Esoterica

Doriansoft noticed that there's a relationship between our pre-Vista security event IDs and our Vista-era security event IDs. For most security events: VistaEventId = PreVistaEventId + 4096 Why is this? We needed to differentiate the Vista events from Read More...

A lot of people are unhappy with object access auditing on Windows, because what they want to know is "who touched the object and what did that person do", but what Windows auditing tells you is actually "who touched the object and what did they ask for Read More...

Here's a cut & paste from one of my Vista machines. This is one of our new events. I'm including the human-formatted view which you'll see in Event Viewer, and the XML view that apps will see (you can see this in the Viewer, too, if you're into that). Read More...