“New” audit Logon/Logoff and other event IDs

When you are searching Logon or Logoff event ID numbers, you may find a lot of old sites talking about ID 528 and ID 538. However, since Windows 7 and Windows Server 2008 R2, these event IDs don’t apply anymore and are completely useless for those more recent operating systems. The Advanced Security Audit Policy […]

[Solved] External USB drive twinkling in Windows Explorer

This week, one of my colleagues logged on to a server and when he opened the file explorer all external USB drives where appearing and disappearing continuously. At the same time, in the upper right corner, several messages appeared asking to unlock all BitLocker-protected drives. This happened on several Windows 2012 R2 servers. After investigation, […]