6

Is there a way to figure out which user and/or which computer is remotely accessing my computer's Windows event log files? These accesses are locking applications on the local computer and thereby preventing their deletion.

This access is showing up in ProcessExplorer as a TCP connection from mmc.exe on the remote machine to port 5001 of svchost.exe (running the "eventlog" service) on the local machine, but that's all I can determine.

I've searched all over for this answer, but haven't found anything of particular use, including digging through WMI objects using PowerShell. Thanks for any help you can offer.

3
  • In resource monitor , in the network section, you could aquire the IP address of connected things. or Netstat /a . What method are you applying to determine that is what is locking an application?
    – Psycogeek
    Mar 14, 2014 at 23:32
  • Have you tried checking netstat /a for the connections? Also, another SysInternals tool - PSLoggedOn - may be of use here. It's a command-line tool that will list users logged on both locally, and via remote resource connections (e.g.: file shares, remote registry, etc.).
    – Iszi
    Aug 20, 2014 at 16:32
  • Have you tried opening Computer Management and opening the tree to System Tools-->Shared Folders? There are folders there for seeing open sessions and also who has locks on files (Open Files). Oct 25, 2014 at 6:05

2 Answers 2

1

First of all - it might not be anybody accessing your eventlogs remotely. Eventlog files are always open. They are memory-mapped files, so you can't just delete them from the disk.
If you need the disk space, you need to open eventvwr.msc and alter the maximum size of the log file there. The change won't take effect until the next restart of the eventlog service (which will probably be when you reboot the machine).
If you want to clear the logs (ie remove the data), you can also do this in the eventvwr mmc snap-in.
If you have a need to keep eventlogs in a deletable file, you can use the AutoBackupLogFiles registry key, but the memory-mapped files will still remain.
If you still suspect that a user account is accessing the eventlog on your computer remotely, and this includes the security log - you should check the security log for events with ID 4672, and look for accounts logging on with SeSecurityPrivilege enabled.
If you don't think the security log is the one being accessed, you can still look for events in the security log with ID 4624, which should show you who has been accessing the computer remotely (but will include all users, not just the one/ones accessing the eventlogs). This should at least narrow your list of suspects.
You could always use wevtutil to add an audit SACL to the logs which you think are being accessed. The process is much the same as for adding permissions (DACL), except you're saying which things should be audited, as opposed to allowed or denied.
Slightly less elegant, but when you notice a connection from the remote IP, you can try running qwinsta /server:remoteIP. This will show you who is logged on at that computer, either locally at the console or via terminal services. It won't help if the "user" is a service account or a scheduled task.

0

You can use Network Monitor to sniff the incoming traffic on that particular port, and the source IP will be displayed clearly. In order to do this:

  • Download and Install Network Monitor from Microsoft into the PC that is getting the remote connections. It's a free tool.
  • Create a new capture, and filter incoming tcp connections to port 5001 (It's quite simple to configure, the UI is friendly).
  • Start the capture and wait until packets arrive, you will see the source IP in the Source field of the list. You could even sniff inside the packets and check whether a hint about authentication is displayed upon connection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .