Re: Can I restore an event log from backup?

From: Sean (spdivr@hotmail.com)
Date: 08/01/02 

From: "Sean" <spdivr@hotmail.com>
Date: Wed, 31 Jul 2002 15:12:12 -0700

Thanks! That path was just what I needed!

>-----Original Message-----
>Sure, why not?
>
>They're stored in %systemroot%\system32\config
>
>
>"Sean" <spdivr@hotmail.com> wrote in message
>news:3e1b01c238d2$2c99a6b0$36ef2ecf@tkmsftngxa12...
>> I made some changes in auditing that quickly overwrote
an
>> event log. Can I do a restore of event logs (only)
from a
>> tape backup from a few days ago? Thanks!
>>
>>
>
>
>.
>

Relevant Pages

  • Re: Security logging stopped
    ... > Try using the Event Log viewer to clear the event log. ... > login successes and failure events was turned on in the RAS server ... > enable auditing on your RAS server: ... > Note that to enable logging of access to files or registry settings, ...
    (microsoft.public.security)
  • Re: possible security worry
    ... Turn on auditing as Austing suggested, ... The reason for it not appearing in the event log could not possibly be ... expiration settings changing and no record of that occurring in the event ... I can see other normal group adds and ...
    (microsoft.public.windows.server.active_directory)
  • Re: Can you Audit logouts??
    ... > I have auditing for logins/logouts turned on. ... > when people are logging in and logging out? ... > see when user John Doe logged out last week one night if ... The event log is painful to go ...
    (microsoft.public.win2000.security)
  • RE: Audit logon events
    ... Check out the System Controls MP from Manakoa. ... Account Management activity and will centralize the data into System Center ... > There are many tools to centralise event log data on the web. ... >> I'm wanting to implement auditing for logon events to try and track ...
    (microsoft.public.windows.server.general)
  • Re: possible security worry
    ... Turn on auditing as Austing suggested, ... eachother PW can lead to situations like this one, ... The reason for it not appearing in the event log could not possibly be ... expiration settings changing and no record of that occurring in the event ...
    (microsoft.public.windows.server.active_directory)