Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to log a security in event in Windows 7 whenever the Microsoft Security Essentials 2 virus definition files are updates, deleted, or changed. I was expecting to do this with an Audit setting on one of the MS Security Essentials folders but I wasn't sure which one and how to avoid getting swamped with messages.

What folder or files should I audit to track definition updates (or corruption) in the security events or is there a better approach?

share|improve this question

migrated from security.stackexchange.com Jan 7 '12 at 20:44

This question came from our site for Information security professionals.

2 Answers 2

This can't be done. instead use the Windows Update log (%SystemRoot%\WindowsUpdate.log)instead.

share|improve this answer
    
But then is there no way to log if another user or program purposely replaces virus definitions? –  Steve Jan 22 '12 at 20:00
    
@Steve what do you mean? –  kinokijuf Jan 23 '12 at 12:07
up vote 0 down vote accepted

Microsoft support provided the following response to this question:

As of now, MSE does not have any such features or user commands that can be used to monitor the changes to its files. However, it protects itself by locking those files and denying access to third party programs or even the user.

Your audit log to monitor C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates folder will take care of the requirement. And this is what our Research Team suggest and recommend.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.