5

I created a Group Policy Object using the Microsoft Management Console to restrict non-adiministrators from being able to do certain things (access the control panel, run regedit etc.). Recently, I discovered that some of these restrictions had been removed.

In investigating the issue, I found that ntuser.pol (the file that holds the group policy information for a user) still reflected the correct settings, but it's corresponding registry hive file ntuser.dat did not.

I believe the ntuser.dat.log1 and ntuser.dat.log2 files may contain information on what process changed ntuser.dat and when. Unfortunately, these files are in a binary format and I can't find a reader for them. I was wondering if there is, in fact, a reader for these types of files or if these files can be used in forensic analysis of ntuser.dat changes in some other way?

Improve this question

1 Answer 1

Reset to default
2

The registry hive log files are not logs in the sense that they keep track of past changes, but rather transaction logs (like database transaction logs). They temporarily store enough information to redo or undo pending transactions to the registry hive. Thus, you can not figure out what process changed a setting or when.

Improve this answer
2
  • 1
    Thanks. I will have to enable logging through secpol.msc or use Process Monitor and wait and see if the changes happen again.
    – graf_ignotiev
    May 17, 2012 at 19:21
  • If you enable auditing, you can put audit ACLs on registry keys.
    – LawrenceC
    Jul 11, 2012 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .