thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Windows Event Log

The structured logging system in Windows that records security, system and application events.

Definition

Key logs include Security (audit events such as logons), System, Application, and channels such as Microsoft-Windows-PowerShell/Operational and Sysmon. Events are stored as .evtx files and viewed in Event Viewer, PowerShell Get-WinEvent or forwarded via Windows Event Forwarding. Audit policy determines which security events are generated.

Example

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} lists failed logons.

Exam tip

Memorize key event IDs: 4624, 4625, 4688, 4720, 4732, 1102, 7045.

Related terms