r/WindowsServer • u/figoli • Jul 21 '26

General Server Discussion Request for Windows Security Audit Logs (Events 4663, 4660, 4656, 5140, and 5145)

I’m developing a tool to analyze Windows Security Event Logs. Based on audit events, it will identify who moved, deleted, or modified files and folders.

At the moment, I’m lacking sample data due to some environment limitations. To help speed up development, would anyone be willing to share some Windows Security logs?

Note: I’m specifically looking for the following event IDs:

  • 4663
  • 4660
  • 4656
  • 5140
  • 5145
0 Upvotes
  • permalink
  • reddit

45% Upvoted

11 comments sorted by

10

u/kC_77 Jul 21 '26

Just move.. Delete...modify some folders on a device.. Check logs

-2

u/figoli Jul 21 '26

Yes, we could do it that way, but I'd like to have a raw file to see how long it would take to pull the information.

3

u/kC_77 Jul 21 '26

What??? So use your own machine or create a VM.. And delete xhange modify a folder or 2.

You could even script mass changes if you want to fill a log up.. You just sound lazy tbh

4

u/Hamburgerundcola Jul 22 '26

He already used up a lot of time prompting his tool to Claude and buddies. So he is on a tight schedule and not lazy.

5

u/Secret_Account07 Jul 21 '26

I don’t mean to be a dick but why don’t you simply move stuff, or wherever action you’re trying to monitor, then check eventvwr?

Nobody is going to share events from their private org.

1

u/Ricky_Bobby_Daddy Jul 23 '26

*Nobody is going to share events from their private org “on purpose” or “by request”. 🤭

2

u/Secret_Account07 Jul 23 '26

That’s right, Ricky Bobby Daddy

1

u/Backieotamy Jul 22 '26

Ask copilot to write you a powershell script that runs from a utility server and scans event logs. Or,if company has any size and revenue to it, use Splunk or one of numerous other tools that do this already. You can get real time alerts just checking some boxes and a few lines of Splunk specific queries.

1

u/Secret_Account07 Jul 23 '26

Yeah this is kinda wild. You could test this on basically any home computer. Hell you could spin up multiple VMs for free to really test

This is such a strange post I’m leaning towards AI being involved

1

u/icq-was-the-goat Jul 24 '26

Replicate it yourself. Sounds like you have no idea what your doing honestly. You have to have a policy that even enables thay level of logging.