Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
3.3 Experiment Results
A summary of the results of the above tests are contained within this section. The
actual test data can be found in Appendix I.
Experiment 1 - Stopping and Restarting the Event Log. It was found that stopping
and restarting the event logging service was a fairly simple task for a user with
administrative privileges, there are two possible techniques both of which provide the
same outcome. The first and easiest way is to navigate to Services Management
Console which is located within the administrative tools folder of the control panel.
Double click Event Log from the list of available services and set the ‘startup type’ to
disabled, then restart the server. Another method is to adjust the startup value setting
in the registry, namely ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Services\Eventlog’ from 0x2 to 0x4. As with the previous method, this will not take
effect until the server has been restarted.
When the server has restarted, an error will be displayed informing the user that ‘at
least one service or driver failed during system startup’. This is normal and will only
be displayed once at the logon screen while the service is disabled. The process of
restarting the service through the Service Management Console is merely a matter of
changing the ‘startup type’ back to automatic, clicking apply and then clicking start.
The service will restart without having to restart the server. It can also be restarted by
changing the startup value in the registry back to 0x2, and to save having to reboot the
machine it can then be started by typing the following in a command prompt window
“net start eventlog”.
Experiment 2 - Copying the Event Log. To simply make a copy of the Security Log,
navigate to ‘C:\Windows\System 32\Config\’ and then right click and select copy on
‘SecEvent.Evt’, this can then simply be pasted into the same directory. It will then
create an exact duplicate of the Security Event file called ‘Copy of SecEvent.Evt’.
This can be done while the event logging service is still running. Figure 3 shows this.
23