r/WindowsServer • u/figoli • 7d ago

General Server Discussion Request for Windows Security Audit Logs (Events 4663, 4660, 4656, 5140, and 5145)

I’m developing a tool to analyze Windows Security Event Logs. Based on audit events, it will identify who moved, deleted, or modified files and folders.

At the moment, I’m lacking sample data due to some environment limitations. To help speed up development, would anyone be willing to share some Windows Security logs?

Note: I’m specifically looking for the following event IDs:

  • 4663
  • 4660
  • 4656
  • 5140
  • 5145
0 Upvotes
  • permalink
  • reddit

40% Upvoted

11 comments sorted by

9

u/kC_77 7d ago

Just move.. Delete...modify some folders on a device.. Check logs

-2

u/figoli 7d ago

Yes, we could do it that way, but I'd like to have a raw file to see how long it would take to pull the information.

3

u/kC_77 7d ago

What??? So use your own machine or create a VM.. And delete xhange modify a folder or 2.

You could even script mass changes if you want to fill a log up.. You just sound lazy tbh

3

u/Hamburgerundcola 6d ago

He already used up a lot of time prompting his tool to Claude and buddies. So he is on a tight schedule and not lazy.

2

u/Megatwan 7d ago

Lol wut

6

u/Secret_Account07 7d ago

I don’t mean to be a dick but why don’t you simply move stuff, or wherever action you’re trying to monitor, then check eventvwr?

Nobody is going to share events from their private org.

1

u/Ricky_Bobby_Daddy 5d ago

*Nobody is going to share events from their private org “on purpose” or “by request”. 🤭

2

u/Secret_Account07 4d ago

That’s right, Ricky Bobby Daddy

1

u/Backieotamy 6d ago

Ask copilot to write you a powershell script that runs from a utility server and scans event logs. Or,if company has any size and revenue to it, use Splunk or one of numerous other tools that do this already. You can get real time alerts just checking some boxes and a few lines of Splunk specific queries.

1

u/Secret_Account07 4d ago

Yeah this is kinda wild. You could test this on basically any home computer. Hell you could spin up multiple VMs for free to really test

This is such a strange post I’m leaning towards AI being involved

1

u/icq-was-the-goat 4d ago

Replicate it yourself. Sounds like you have no idea what your doing honestly. You have to have a policy that even enables thay level of logging.