Continued use of Windows will generate a large number of log files, but how can one easily monitor these files without having to go through a series of mouse clicks? Well, recently, we’ve been testing ...

Event 4688 documents each program a computer executes, its identifying data, and the process that started it. Several event 4688s occur on your system when you log into a system. For example, Session ...

In Event Viewer, the errors logged are common, and you will come across different errors with different Event IDs. The events that are recorded in the security logs usually will be either of the ...

These logs often contain traces left behind by ransomware attacks that could reveal the entry points used by the attackers and their "digital identity." Here are some examples of ransomware traces ...

The default event logging in Windows 10 won't give you enough information to properly conduct intrusion forensics. These settings and tools will help you collect the needed log data. After a ...

I'm writing a Windows app in unmanaged C++ and want to log some simple events to the Application log. I'm normally a *nix guy and am used to being able to just call syslog() (or asl(3) on Mac OS X). I ...

Microsoft has released Sysmon 15, converting it into a protected process and adding the new ‘FileExecutableDetected’ option to log when executable files are created. For those not familiar with Sysmon ...

Can anyone recommend software for monitoring and analyzing event logs across a Windows 2003 domain? Something that will let me query for specific events, and perhaps even automatically notify me via ...