Hi All, I need to check “Event Logging Should be Enabled and Restricted to Auditors and System Admin” in windows 7.
Earlier we have below relevance but its only working on Windows XP.
not exists running services “Eventlog” or (not exists 1 whose (conjunction of ((item 0 of it = item 1 of it) of (set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of it, set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of “0,%22D:AR(A;OICI;FR;;;BA)(A;OICI;FA;;;SY)%22”)) of elements of (if size of it < 1 then error “no file” else it) of set of (it as string) of security descriptors of (if exists security descriptor of windows folder or true then ((if exists x64 file it then x64 file it else nothing); (if exists x32 file it then x32 file it else nothing)) else error “unknown”) of expand environment string of “%25SystemRoot%25\system32\config\AppEvent.Evt”) ) or (not exists 1 whose (conjunction of ((item 0 of it = item 1 of it) of (set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of it, set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of “0,%22D:AR(A;OICI;FR;;;BA)(A;OICI;FA;;;SY)%22”)) of elements of (if size of it < 1 then error “no file” else it) of set of (it as string) of security descriptors of (if exists security descriptor of windows folder or true then ((if exists x64 file it then x64 file it else nothing); (if exists x32 file it then x32 file it else nothing)) else error “unknown”) of expand environment string of “%25SystemRoot%25\system32\config\SecEvent.Evt”)) or (not exists 1 whose (conjunction of ((item 0 of it = item 1 of it) of (set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of it, set of (concatenation “-” of (parenthesized part 1 of it; parenthesized part 3 of it; parenthesized part 6 of it)) of matches (regex “^((.);(.);(.);(.);(.);(.))$”) of matches (regex “([^)]+)”) of “0,%22D:AR(A;OICI;FR;;;BA)(A;OICI;FA;;;SY)%22”)) of elements of (if size of it < 1 then error “no file” else it) of set of (it as string) of security descriptors of (if exists security descriptor of windows folder or true then ((if exists x64 file it then x64 file it else nothing); (if exists x32 file it then x32 file it else nothing)) else error “unknown”) of expand environment string of “%25SystemRoot%25\system32\config\SysEvent.Evt”))