Tag: Audit

“New” audit Logon/Logoff and other event IDs

When you are searching Logon or Logoff event ID numbers, you may find a lot of old sites talking about ID 528 and ID 538. However, since Windows 7 and Windows Server 2008 R2, these event IDs don't apply anymore and are completely useless for those more recent operating systems. The Advanced Security Audit Policy … Continue reading “New” audit Logon/Logoff and other event IDs

How to change advanced audit settings with Powershell

How to change advanced audit settings with Powershell

Disclaimer This is for advanced users only. If Microsoft has hidden this registry key and removed permissions for administrators, it's probably for a good reason. Thus, the following script is provided as is. Don't use it or modify it if you don't understand what you are doing, or if you are not aware of the … Continue reading How to change advanced audit settings with Powershell

[Solved] External USB drive twinkling in Windows Explorer

This week, one of my colleagues logged on to a server and when he opened the file explorer all external USB drives where appearing and disappearing continuously. At the same time, in the upper right corner, several messages appeared asking to unlock all BitLocker-protected drives. This happened on several Windows 2012 R2 servers. After investigation, … Continue reading [Solved] External USB drive twinkling in Windows Explorer