Understanding Windows Event Logs: A Beginner's Guide to Endpoint Telemetry

Every time an operating system performs an action—a user enters a password, a program opens, or a network share is accessed—it leaves behind a record. On Windows systems, these records are saved in structured files called Windows Event Logs.

For anyone starting out in security operations, learning how to read and interpret these logs is a foundational skill. Logs provide the primary paper trail used during incident response to determine how an attacker gained access, what commands they executed, and which accounts were compromised.

Core Concepts and Terminology

Before opening log viewers, it helps to understand a few basic terms used daily in security operations:

Telemetry: Automated data collected from computers, servers, and network devices about system performance, user activity, and health. Event logs are a major source of endpoint telemetry.
Event Log: A file maintained by Windows that records system, application, and security events. On disk, these are saved in binary format with the .evtx extension (located by default in C:\Windows\System32\winevt\Logs).
Event ID: A numerical identifier assigned by Microsoft to represent a specific action. For example, successful user authentication always triggers Event ID 4624.
Audit Policy: A configuration in Windows that defines which events the operating system records. By default, Windows does not log every action to save disk space, so administrators must configure audit policies to capture security-relevant events.

Accessing Event Logs in Windows

Windows includes a built-in tool called Event Viewer (eventvwr.msc). You can open it on any Windows host by pressing Windows Key + R, typing eventvwr.msc, and pressing Enter.

Inside Event Viewer, logs are divided into primary channels under Windows Logs:

Security: Contains security-related events like authentication attempts, privilege usage, and account creation. Accessing this log requires administrative privileges.
System: Contains events logged by core Windows components, such as driver loading errors, system startups, or service status changes.
Application: Contains events logged by installed software (such as database errors or crash reports).
Forwarded Events: Stores logs collected from other remote computers on the network using Windows Event Forwarding (WEF).

Modern Windows versions also feature Applications and Services Logs, which hold specialized logs for components like PowerShell (Microsoft-Windows-PowerShell/Operational) and Task Scheduler.

Essential Event IDs Every Analyst Should Know

While Windows generates thousands of event types, a small subset accounts for most daily defensive investigations. Here are key Event IDs categorized by operational domain.

1. User Authentication Logs

Tracking who logged in, when, and how is crucial for spotting unauthorized access.

Event ID 4624 (Successful Logon): Recorded when an account successfully authenticates.
- Key Detail: Pay attention to the Logon Type field.
  - Type 2 (Interactive): A user logged in locally at the physical keyboard.
  - Type 3 (Network): A user connected remotely across the network (e.g., accessing a shared folder).
  - Type 10 (Remote Interactive / RDP): A user connected remotely using Remote Desktop.
Event ID 4625 (Failed Logon): Recorded when an authentication attempt fails due to an invalid password, disabled account, or bad username.
- Practical Example: A single host recording hundreds of Event ID 4625 events from a single account within seconds indicates a password brute-force or guessing attempt.

2. Process Creation Logs

Knowing what programs ran on a system allows analysts to detect malicious activity like malware execution or unauthorized utility usage.

Event ID 4688 (A new process has been created): Recorded whenever an application or command-line utility starts.
- Key Detail: Look at New Process Name (the program that ran) and Creator Process Name (the parent process that launched it).
- Practical Example: If winword.exe (Microsoft Word) launches cmd.exe (Command Prompt) or powershell.exe, that child process execution warrants immediate investigation, as office applications rarely need to launch command line shells natively.

3. Account Management Logs

Attackers often create new user accounts or elevate existing accounts to maintain persistent access.

Event ID 4720 (A user account was created): Recorded when a local or domain user account is created.
Event ID 4732 / 4728 (A member was added to a security group): Recorded when a user account is added to a local or domain group (such as the local Administrators group).

4. Anti-Forensic Activity

Event ID 1102 (The audit log was cleared): Recorded in the Security channel when someone clears the security log. Attackers sometimes attempt to erase log data to cover their tracks before exiting a compromised system.

Practical Scenario: Investigating an Unauthorized Account Creation

To understand how these logs work together, let’s walk through a realistic investigation scenario.

Suppose a alert fires in a Security Operations Center (SOC) indicating suspicious account modifications on a workstation named WORKSTATION-05.

Here is how an analyst uses event logs to reconstruct the timeline:

Filter for Event ID 4720: The analyst opens the Security log and filters for Event ID 4720. They discover an entry at 14:22:10 showing that a local user account named support_admin was created.
Identify the Acting User: Looking at the Subject fields of Event ID 4720, the analyst sees that the account jdoe created support_admin.
Check Group Membership Changes: Searching for Event ID 4732 around the same timestamp reveals that at 14:22:12, support_admin was added to the Builtin\Administrators group by jdoe.
Examine Process Telemetry (Event ID 4688): Filtering for process creation events around 14:22:00 reveals that cmd.exe was executed with the following process command line:
```
net user support_admin ComplexPass123! /add
net localgroup administrators support_admin /add
```
Interview and Validate: The analyst checks with the user jdoe or change management records. If jdoe was away from their desk or no maintenance ticket exists, the analyst confirms that jdoe’s credentials were compromised and used to establish persistence.

Limitations and Common Gaps

While Windows Event Logs are essential, relying on stock installations presents technical limitations:

Command-Line Logging is Disabled by Default: Stock Windows configurations record Event ID 4688 when a process starts, but they omit the command-line arguments (e.g., net user ...). Without command-line auditing enabled via Group Policy, analysts only see that net.exe ran, not what parameters were passed to it.
Local Log Overwriting: Event log files use a circular buffer format with fixed size caps (typically 20 MB by default). On active domain controllers or busy servers, logs can overwrite within hours, causing historical data to disappear before an investigation begins.
Local Log Tampering: An attacker with administrative privileges can clear local log files or stop the EventLog service entirely.

Practical Defensive Recommendations

To overcome these default limitations, security teams implement several basic improvements:

Enable Command-Line Logging: In Group Policy Editor (gpedit.msc), navigate to: Computer Configuration -> Administrative Templates -> System -> Audit Process Creation Enable Include command line in process creation events.
Enable Audit Policies Explicitly: Configure Local Security Policy (secpol.msc) under Advanced Audit Policy Configuration to ensure detailed tracking for Audit Logon, Audit Account Management, and Audit Process Creation are set to record Success and Failure.
Forward Logs Centrally: Use Windows Event Forwarding (WEF) or install a central log collector agent (such as a SIEM agent) to transfer logs off endpoints in near real-time. Even if an attacker wipes local .evtx files, copies remain safely preserved on the central log server.
Alert on Log Wiping: Configure high-severity alerts whenever Event ID 1102 (Security log cleared) occurs across the network.

Final Thoughts

Windows Event Logs provide essential visibility into endpoint operations. Understanding key Event IDs—such as 4624 for logons, 4688 for process starts, and 4720 for account creations—allows security practitioners to quickly convert raw operational data into actionable context during an investigation.