Remove Single Entry from Event Log ?
jibbajabba
Member Posts: 4,317 ■■■■■■■■□□
in Off-Topic
Just wondering if there is a way to remove a single line from a system event log in Server 2003.
And I don't mean filtering etc., I mean if there is a way that someone remove a line from an event log to cover up 'something'.
We have a server with a suspicious event log and I am trying to find out whether it is possible that the person in question managed to remove certain entries or if this is just a Windows related weirdness ...
And I don't mean filtering etc., I mean if there is a way that someone remove a line from an event log to cover up 'something'.
We have a server with a suspicious event log and I am trying to find out whether it is possible that the person in question managed to remove certain entries or if this is just a Windows related weirdness ...
My own knowledge base made public: http://open902.com 
Comments
-
astorrs
Member Posts: 3,139 ■■■■■■□□□□
No its not; There are no API calls to remove/delete anything (only clear the entire log)