Lost security event log details

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello,
After applying a dumb security configuration to my machine using secedit, I
lost the verbose view of my security log. Is there an efficient way to repair
it?

Regards,

Sébastien Mouren
 
Thanks for your answer.
It's exactly what I did. And it didn't resolve my problem.
I resolved it a few days ago.
My problem concerned keys under
HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}
that weren't well DACLed and whose Owner was bad.
The secsetup.inf file doesn't enforce nor contains explicit DACLs for those.

It's a shame MS doesn't offer you a global, efficient, and complete way to
control if your system is in shape and behaves as it should.

A tools with all the out of the box settings for every part of the system,
containing a report of signed, compared files could constitute an appreciated
enhancement to the OS.

Regards,

Sébastien
 
Thanks for reporting back what worked. You can use System File Checker to
check the integrity of system files but for all registry permissions you
would need a solution that includes a backup such as that of the System
State to be able to restore your registry from a known good backup. You will
see the backup the System State option with the built in NTbackup.

Steve
 
Back
Top