Event Log¶
Everything else on this site is prevention. Logs are how you find out whether it worked, and what happened when it didn't. Without them a machine can be compromised for months with no record.
The service¶
The Windows Event Log service (EventLog) collects events. It must be running; an attacker's first move is often to stop it.
Get-Service EventLog | Select Status, StartType
Running, Automatic. If not: Set-Service EventLog -StartupType Automatic; Start-Service EventLog.
Event Viewer¶
eventvwr.msc. Under Windows Logs:
| Log | Contains |
|---|---|
| Security | Logons, logoffs, account changes, privilege use, policy changes. The important one. |
| System | Windows components: services starting and stopping, drivers, startup and shutdown |
| Application | Installed programs |
| Setup | Windows installation and updates |
The Security log only records what audit policy tells it to. On a machine with no audit policy, it's nearly empty. The next page fixes that.
Log size¶
A log that fills up either stops recording or overwrites the oldest events. Give every log room, and the Security log the most.
The benchmark sets these by policy so they can't be shrunk from Event Viewer: gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Event Log Service → one folder per log.
| CIS | Log | Specify the maximum log file size (KB) | Control Event Log behavior when the log file reaches its maximum size |
|---|---|---|---|
| 18.10.26.2.1, 18.10.26.2.2 | Security | Enabled: 196608 or greater (STIG: 1024000, about 1 GB) | Disabled (overwrite as needed) |
| 18.10.26.1.1, 18.10.26.1.2 | Application | Enabled: 32768 or greater | Disabled |
| 18.10.26.3.1, 18.10.26.3.2 | Setup | Enabled: 32768 or greater | Disabled |
| 18.10.26.4.1, 18.10.26.4.2 | System | Enabled: 32768 or greater | Disabled |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" /v MaxSize /t REG_DWORD /d 196608 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" /v Retention /t REG_SZ /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" /v MaxSize /t REG_DWORD /d 32768 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" /v Retention /t REG_SZ /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" /v MaxSize /t REG_DWORD /d 32768 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" /v Retention /t REG_SZ /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" /v MaxSize /t REG_DWORD /d 32768 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" /v Retention /t REG_SZ /d 0 /f
Or by hand, per log:
Event Viewer → right-click Security → Properties:
- Maximum log size: at least 196608 KB (192 MB)
- When maximum event log size is reached: Overwrite events as needed
Never choose "Do not overwrite events" on a competition image. When the log fills, Windows can refuse logons.
Command line:
wevtutil sl Security /ms:201326592
wevtutil sl Security /rt:false
Log file permissions¶
The log files themselves live in C:\Windows\System32\winevt\Logs\. If a normal user can read them, they can see what's been recorded about them; if they can write, they can erase it. The STIG (WN11-AU-000515 to 000525) requires the defaults: only SYSTEM, Administrators, and the Eventlog service have access.
icacls C:\Windows\System32\winevt\Logs\Security.evtx
Expected: NT SERVICE\EventLog:(I)(F), NT AUTHORITY\SYSTEM:(I)(F), BUILTIN\Administrators:(I)(F), and nothing else. Any Users or Everyone entry is a finding.
Verify¶
wevtutil gl Security
Shows maxSize and retention: false (false means overwrite as needed).
Example¶
Get-Service EventLog shows Stopped, Disabled. Nothing has been logged since it was disabled. Re-enable and start it, then check the Security log properties: maximum size is 1024 KB, which holds about an hour of events on a busy machine. Raise it.