I created a Group Policy Object using the Microsoft Management Console to restrict non-adiministrators from being able to do certain things (access the control panel, run regedit etc.). Recently, I discovered that some of these restrictions had been removed.
In investigating the issue, I found that ntuser.pol (the file that holds the group policy information for a user) still reflected the correct settings, but it's corresponding registry hive file ntuser.dat did not.
I believe the ntuser.dat.log1 and ntuser.dat.log2 files may contain information on what process changed ntuser.dat and when. Unfortunately, these files are in a binary format and I can't find a reader for them. I was wondering if there is, in fact, a reader for these types of files or if these files can be used in forensic analysis of ntuser.dat changes in some other way?