Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to log a security in event in Windows 7 whenever the Microsoft Security Essentials 2 virus definition files are updates, deleted, or changed. I was expecting to do this with an Audit setting on one of the MS Security Essentials folders but I wasn't sure which one and how to avoid getting swamped with messages.

What folder or files should I audit to track definition updates (or corruption) in the security events or is there a better approach?

share|improve this question

migrated from Jan 7 '12 at 20:44

This question came from our site for information security professionals.

This can't be done. instead use the Windows Update log (%SystemRoot%\WindowsUpdate.log)instead.

share|improve this answer
But then is there no way to log if another user or program purposely replaces virus definitions? – Steve Jan 22 '12 at 20:00
@Steve what do you mean? – kinokijuf Jan 23 '12 at 12:07
up vote 0 down vote accepted

Microsoft support provided the following response to this question:

As of now, MSE does not have any such features or user commands that can be used to monitor the changes to its files. However, it protects itself by locking those files and denying access to third party programs or even the user.

Your audit log to monitor C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates folder will take care of the requirement. And this is what our Research Team suggest and recommend.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .