Event Log Management in Windows | TryHackMe Windows Event Logs

In this video walkthrough, we covered managing logs in windows using event viewer, powershell and windows command line. We examined also a scenario to investigate a cyber incident.
#windows
#powershellscripting
*******
Receive Cyber Security Field, Certifications Notes and Special Training Videos
Answers
**********
TryHackMe Windows Event Logs
********
LinkedIn
Instagram
Twitter
Facebook

[HundredAcres]

@1:02:15 The reason that the Group Security Id isn't the 551 one is because the question states that it is an "Administrator Group". The first group that we see is a "BackUp Operators" group.

[Maccanarchy]

I'm literally commenting on all your videos just to help you get more reach, your work is amazing mate. Thanks again

[kevinweeks]

You saved me yet again Motasem. @9:21 the video shows a directive that the website must have missed. In my version of TryHackMe WEL room it does not as easily differentiate between the two logs. (they sound the same... powershell log sounds like a quicker way of saying powershell operational log.... but its a different log entirely) Oddly this is the one question that needs a hint but does not have one.

I would also like to comment how your thorough video walkthroughs provide so much more information than the room ever could. I find myself listening to your side commentary more than the actual relational room vocale!

Thank you David
תודה לך דוד

[ahmedmoaz]

thank you ur doing well and about this all informtaions

[jamilshekinski]

Thank you habibi for the walk-through!! You're a lifesaver!!
Btw, how did you set-up your Kali desktop so nicely?

[NaidsVibes]

Thank you very much. This is very helpful

[Martin-rniu]

Thank you for doing this I’m learning so much !!

[love-beef]

Thanks so much for this sir, you dey motivate me. God Bless

[deonmarfo]

Hey Morten you mentioned your using a deployed machine using rdp how do you do that ?

[jerald]

Hi at 49:15 why do you take the first result 12/18/2020 7:50:33AM ? Isn't that the latest and not the first event?

[reconxf]

I’m kinda confused why you chose 104
For event Id and how do u make a new line without adding ‘ n or r I tried googling it but always tells me
To use ‘n or ‘r

[cesarbelmonte]

What event files would be read when using the query-events command?

[pograva]

Hi, in the event Logs, in task 3 the question :What event files would be read when using the query-events command? is change, Can you help with new answer? Tanks 😊

[lsosa]

How were you able to filter the events using Get-WinEvent from the merged.evtx file?

[omaralmardi]

46:45 ما بعرفش شو بدي احكي 😂😂😂 out of context

[robertochieng]

i was able to follow this tutorial and i was able to get the powershell scrpit for task 7 Group security ID and event ID

Group Security ID

event ID