Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I created a Group Policy Object using the Microsoft Management Console to restrict non-adiministrators from being able to do certain things (access the control panel, run regedit etc.). Recently, I discovered that some of these restrictions had been removed.

In investigating the issue, I found that ntuser.pol (the file that holds the group policy information for a user) still reflected the correct settings, but it's corresponding registry hive file ntuser.dat did not.

I believe the ntuser.dat.log1 and ntuser.dat.log2 files may contain information on what process changed ntuser.dat and when. Unfortunately, these files are in a binary format and I can't find a reader for them. I was wondering if there is, in fact, a reader for these types of files or if these files can be used in forensic analysis of ntuser.dat changes in some other way?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The registry hive log files are not logs in the sense that they keep track of past changes, but rather transaction logs (like database transaction logs). They temporarily store enough information to redo or undo pending transactions to the registry hive. Thus, you can not figure out what process changed a setting or when.

share|improve this answer
1  
Thanks. I will have to enable logging through secpol.msc or use Process Monitor and wait and see if the changes happen again. –  graf_ignotiev May 17 '12 at 19:21
    
If you enable auditing, you can put audit ACLs on registry keys. –  ultrasawblade Jul 11 '12 at 13:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.