Back to course

Essential Logging in Windows Events

Cyber Security Mastery: From Zero to Hero

Monitoring Windows Activity

Windows stores detailed records of system, application, and security activity in the Event Log.

Key Event Logs

  1. Application Log: Events logged by applications (e.g., an application error).
  2. Security Log: Contains audit records related to authentication (logins/logouts) and object access (file opens/changes).
  3. System Log: Events logged by the Windows OS components (e.g., driver failures, boot events).

Critical Events to Monitor (Security Log)

Event IDDescription
4624Account successfully logged on.
4625Account failed to log on (often indicates brute force).
4720A new user account was created.
4732/4733Security group membership changed (Privilege Escalation indicator).

For security monitoring, these logs are forwarded to the SIEM system for analysis.