Event Log¶

Everything else on this site is prevention. Logs are how you find out whether it worked, and what happened when it didn't. Without them a machine can be compromised for months with no record.

The service¶

The Windows Event Log service (EventLog) collects events. It must be running; an attacker's first move is often to stop it.

Get-Service EventLog | Select Status, StartType

Running, Automatic. If not: Set-Service EventLog -StartupType Automatic; Start-Service EventLog.

Event Viewer¶

eventvwr.msc. Under Windows Logs:

Log	Contains
Security	Logons, logoffs, account changes, privilege use, policy changes. The important one.
System	Windows components: services starting and stopping, drivers, startup and shutdown
Application	Installed programs
Setup	Windows installation and updates

The Security log only records what audit policy tells it to. On a machine with no audit policy, it's nearly empty. The next page fixes that.

Log size¶

A log that fills up either stops recording or overwrites the oldest events. Give every log room, and the Security log the most.

The benchmark sets these by policy so they can't be shrunk from Event Viewer: gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Event Log Service → one folder per log.

CIS	Log	Specify the maximum log file size (KB)	Control Event Log behavior when the log file reaches its maximum size
18.10.26.2.1, 18.10.26.2.2	Security	Enabled: 196608 or greater (Windows 11 STIG: 1024000, about 1 GB; Server 2022 STIG: 196608)	Disabled (overwrite as needed)
18.10.26.1.1, 18.10.26.1.2	Application	Enabled: 32768 or greater	Disabled
18.10.26.3.1, 18.10.26.3.2	Setup	Enabled: 32768 or greater	Disabled
18.10.26.4.1, 18.10.26.4.2	System	Enabled: 32768 or greater	Disabled

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" /v MaxSize /t REG_DWORD /d 196608 /f

One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:

Key	Value	Type	Data
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security`	`MaxSize`	REG_DWORD	`196608`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security`	`Retention`	REG_SZ	`0`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application`	`MaxSize`	REG_DWORD	`32768`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application`	`Retention`	REG_SZ	`0`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup`	`MaxSize`	REG_DWORD	`32768`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup`	`Retention`	REG_SZ	`0`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\System`	`MaxSize`	REG_DWORD	`32768`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\System`	`Retention`	REG_SZ	`0`

Or by hand, per log:

Event Viewer → right-click Security → Properties:

Maximum log size: at least 196608 KB (192 MB)
When maximum event log size is reached: Overwrite events as needed

Never choose "Do not overwrite events" on a competition image. When the log fills, Windows can refuse logons.

Command line:

wevtutil sl Security /ms:201326592
wevtutil sl Security /rt:false

Log file permissions¶

A user who can write to the log file can erase the record of what they did. The STIG (WN11-AU-000515 to 000525 on Windows 11; WN22-AU-000030 to 000060 on Server 2022, which adds the Event Viewer executable) wants the Application, Security, and System log files, and eventvwr.exe itself, at their defaults.

icacls C:\Windows\System32\winevt\Logs\Security.evtx
icacls C:\Windows\System32\winevt\Logs\Application.evtx
icacls C:\Windows\System32\winevt\Logs\System.evtx
icacls C:\Windows\System32\eventvwr.exe

The log files should list only NT SERVICE\EventLog, SYSTEM, and Administrators with full control. eventvwr.exe should show TrustedInstaller with full control and everyone else (Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES) at read and execute. Users, Everyone, or a named account with write access on any of them is a finding; remove the entry:

icacls C:\Windows\System32\winevt\Logs\Security.evtx /remove:g Users

Verify¶

wevtutil gl Security

Shows maxSize and retention: false (false means overwrite as needed).

Example¶

Get-Service EventLog shows Stopped, Disabled. Nothing has been logged since it was disabled. Re-enable and start it, then check the Security log properties: maximum size is 1024 KB, which holds about an hour of events on a busy machine. Raise it.

Try it¶

Set the log sizes and check them in Event Viewer properties.
Read icacls on the three log files and eventvwr.exe.

Build it¶

An eventlog.bat with the reg add lines for log sizes and an icacls check of the log files.

Next¶

Audit Policy