Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a Group Policy Object using the Microsoft Management Console to restrict non-adiministrators from being able to do certain things (access the control panel, run regedit etc.). Recently, I discovered that some of these restrictions had been removed.

In investigating the issue, I found that ntuser.pol (the file that holds the group policy information for a user) still reflected the correct settings, but it's corresponding registry hive file ntuser.dat did not.

I believe the ntuser.dat.log1 and ntuser.dat.log2 files may contain information on what process changed ntuser.dat and when. Unfortunately, these files are in a binary format and I can't find a reader for them. I was wondering if there is, in fact, a reader for these types of files or if these files can be used in forensic analysis of ntuser.dat changes in some other way?

share|improve this question
up vote 2 down vote accepted

The registry hive log files are not logs in the sense that they keep track of past changes, but rather transaction logs (like database transaction logs). They temporarily store enough information to redo or undo pending transactions to the registry hive. Thus, you can not figure out what process changed a setting or when.

share|improve this answer
Thanks. I will have to enable logging through secpol.msc or use Process Monitor and wait and see if the changes happen again. – graf_ignotiev May 17 '12 at 19:21
If you enable auditing, you can put audit ACLs on registry keys. – LawrenceC Jul 11 '12 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .