How do I identify the latest file modifications, application install, and registry key modification for Security Forensics.... using GP Audit for registry/file system

Question

Hello,
Title pretty much states it all. I initially set out (as part of a Security Forensics initiative) to identify the most recently installed applications, modified files, and registry key changes using PowerShell. I attempted to pull this information and sort
them by date installed/last modified, but it was brought to my attention this information isn't always present and can be modified - so it's not accurate.
At that time it was suggested we use Group Policy auditing for Registry and File System -  but I'm not sure how I'm going to use/pull these in PowerShell? This will be used on remote host all over the world so local physical access isn't an option.
My question is:
Once Group Policy Auditing for Registry and File System has been enabled, how would I go about pulling those audit logs for review once a system has been identified as compromised? I'm brand new to this GP Auditing (we have a separate team for that) so feel
free to take it from the beginning. :)
Thanks in advance!

Answer 1

Hi,
Here are a few suggestions for you:
Ensure Remote Registry service is started on local and remote machines.
Add the – Credential option and supply administrative credentials within the command.
More information for you:
Get-Eventlog doesn't work against Vista/W7 clients
https://social.technet.microsoft.com/Forums/en-US/c5185a01-b0d2-49a7-9aa7-52e6534ada04/geteventlog-doesnt-work-against-vistaw7-clients?forum=winserverpowershell
PowerShell - How to Get XML EventData - Remote Eventlogs - Exchange Events
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/382b10c9-d740-46b1-b81c-b24de911eb14/powershell-how-to-get-xml-eventdata-remote-eventlogs-exchange-events-?forum=ITCG
Powershell script to gather failed logon attempts by event id and type from the security events log
https://social.technet.microsoft.com/Forums/scriptcenter/es-ES/00a62492-c63a-4c8b-92f9-1cc857223a00/powershell-script-to-gather-failed-logon-attempts-by-event-id-and-type-from-the-security-events-log?forum=ITCG
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]