Security Log Resource

This week has been a busy one for me.  I have had several web training sessions and 2 onsite training sessions with customers this week.  A question came up during one of onsites this week and I thought I would share it.  The question was where did I get all my knowledge about the Windows Event Log and the various Event ID’s.

The answer is a simple 2 part answer. Part 1 –> Repetition, repetition, repetition.  I have been analyizing event logs for more than 3 years now and before that I was a Sys Admin.  Looking at the events day in and day you tend to get them stuck in your head.  Part 2 –> Resources such as the information that I’ve learned from reading Randy F. Smith’s book and reviewing his course documentation and visiting his web site: www.ultimatewindowssecurity.com.  I have put a link to a new feature on Randy’s site, WinSecWiki, under my Blogrolls.  I also attend his webinars to get more info.  Randy has good insite to the Security log.  I have also had several conversations with Randy.

From time to time I will contribute to Randy’s Wiki, I will be posting under my first name on his site. 

If anyone has any questions about Windows Events or the Windows Audit Policy feel free to ask.

Tracking Down Audit Policy Changes

Yesterday I held a webinar about how to track down changes to your Audit Policy.  I have had several requests for the recorded session link from the people who attended.  So I thought I would share the webinar with everyone else.  To view the webinar please visit: http://www.prismmicrosys.com/Support/trainingDetails.php?id=116&a=view.html

For a list of my other upcoming webinars you can visit: http://www.prismmicrosys.com/webinars.php#Log%20Management%20Secrets

They are listed under the Log Management Secrets section.  I will be conducting webinars each Tuesday at 1 pm Eastern Time on various topics relating to event log management and security.  Please feel free to join in the webinars.