-4

One of our IT Security Analysts is out on maternity leave

She had wiped the Windows Event Viewer logs off of a PC. Before we confront her we wanted to find out if there is any business reason for wiping these event logs.

I’m not an IT person so I’m not sure but we want to make sure that we give her a fair chance at explaining her actions when she returns to work.

closed as unclear what you're asking by Twisty Impersonator, Ramhound, Journeyman Geek Sep 14 '18 at 3:41

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    How do you know, this personed wiped the event logs, is there an event of that happening? – Ramhound Sep 13 '18 at 21:35
  • Yes there is an event indicating she wiped the logs. – JavaScripter007 Sep 13 '18 at 22:38
  • 1
    What was logged exactly? – Ramhound Sep 13 '18 at 22:59
  • 6
    Just to add. The timing of this - based off your question is fishy. Be very careful about what you do - if you're trying to fire someone on maternity leave and are trying to find reasons after the fact, its pretty illegal in many jurisdictions. – Journeyman Geek Sep 14 '18 at 4:21
7

She had wiped the Windows Event Viewer logs off of a PC.

In a typical corporate setup, the event logs are archived by size, which creates an archive file. So before you confront somebody, about something you admit you know very little about, you might want to check the configuration of the machine. This same functionality can rotate logs, so an archive is NOT created, which means older events would eventually be overwritten by more recent activity.

I’m not an IT person so I’m not sure but we want to make sure that we give her a fair chance at explaining her actions when she returns to work.

Based on this statement alone, you shouldn't confront the security analyst in question, because it appears you are unfamiliar with how the system is actually configured. As an Administrator myself, If somebody came to me who in their own words, describe themselves as "not an IT person" I would go to their manager immediately and make sure they are disciplined.

If another Administrator came to me, I would explain my actions and would move on with my life. As an Administrator, there are numerous situations, where cleaning up the events that have been logged would be acceptable behavior.

  • 4
    @JavaScripter007 - No; There are far to many to provide a list, the situations I can think of, would be far specific to the network I am an Administrator of. The list wouldn’t be helpful to anyone outside of my organization. I won’t speculate what reasons this Administrator had to clear the events in question. – Ramhound Sep 13 '18 at 22:58
  • You can't even provide 1 or 2 reasons? @Ramhound – JavaScripter007 Sep 13 '18 at 23:56
  • 1
    @JavaScripter007 The event log was corrupt and until I cleared it no more events would get logged. – Twisty Impersonator Sep 14 '18 at 2:07
  • 2
    @JavaScripter007 - Can I provide 1 or 2 reasons, I absolutely could provide them. I have answered your question, as it’s written, and won’t be providing those reasons. I also won’t be returning to this question. – Ramhound Sep 14 '18 at 3:05
-1

A number of different 'cleaning' apps suggest deleting them to save space. She might have installed one of those to resolve a different issue, and not understood the implications of letting such an app clean away the logs.

  • 4
    That is gross speculation. The questioner admits to knowing very little about IT so it's highly unlikely that he's done an research or investigation to determine if anyone wiped the logs at all or if it was a system setting such as rotating the logs. – Nasir Riley Sep 13 '18 at 21:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.