> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/windows-security-log.md).

# Windows Security Log

## Objective

Understand the purpose of the Windows Security log and learn how to review security-related events.

## Lab Systems

Use both:

```
DC01
CLIENT01
```

## Steps

### 1. Open the Security Log

On `CLIENT01`, open:

```
Event Viewer
└── Windows Logs
    └── Security
```

Depending on the activity and audit settings, you may see many events.

### 2. Review the Main Fields

Open several recent events and identify:

* Event ID
* Logged time
* Computer
* Account Name
* Account Domain
* Logon Type, where applicable
* Source Network Address, where applicable
* Process information, where applicable

Not every event contains every field.

### 3. Compare CLIENT01 and DC01

Open the Security log on `DC01` as well.

Notice that events are recorded on the system that processes or observes the activity. For example, some domain authentication and account-management events are more relevant on the domain controller, while interactive workstation activity may be visible on the client.

## Useful Beginner Event IDs

The following event IDs will appear frequently in later ZyberLab exercises:

| Event ID | Meaning                                     |
| -------- | ------------------------------------------- |
| 4624     | Successful logon                            |
| 4625     | Failed logon                                |
| 4634     | Account logged off                          |
| 4648     | Logon attempted using explicit credentials  |
| 4720     | User account created                        |
| 4726     | User account deleted                        |
| 4728     | Member added to a global security group     |
| 4729     | Member removed from a global security group |
| 4740     | User account locked out                     |

Do not treat this table as a complete Windows security event catalog. It is only a small starter set.

## What Happened?

The Security log contains events generated by Windows auditing. Which events appear depends on the system role, the action performed, and the configured audit policy.

## Security Relevance

Security monitoring platforms such as SIEM tools often collect Windows Security events and use them to detect suspicious behavior. Understanding the original Windows event makes later SIEM alerts much easier to interpret.

## Key Takeaways

* The Security log is one of the most important Windows sources for security investigations.
* Event IDs classify activity, but event fields provide the investigative context.
* DC01 and CLIENT01 may record different parts of the same activity.
* Audit configuration determines what Windows records.