Centralized Logging with Windows

The video tutorial by Toby from Oine Security covers setting up a centralized logging system using Windows servers. It explains the importance of monitoring events for security purposes and demonstrates configuring a Windows server (DC10) to collect logs from another server (MS10). The tutorial includes detailed steps using PowerShell commands to enable remote event logging and verify the setup through the Windows Event Viewer. The video concludes with a review and questions about centralized logging management.

What is the primary purpose of a centralized logging server?

• To enhance internet speed

• To store all network data

• To monitor and collect events from various network devices

• To replace firewalls and routers

Which tool is commonly used for centralized logging in many use cases?

• SIM tool

• Firewall

• Router

• Antivirus software

What command is used to enable the WinRM listener on dc10?

• winrm quickconfig

• Enable-PSRemoting

• Start-Service

• Enable-EventLog

What is the role of ms10 in the centralized logging setup?

• It acts as the main server

• It forwards logs to the centralized server

• It replaces the centralized server

• It monitors the centralized server

Which application is used on dc10 to collect logs from ms10?

• Control Panel

• Event Viewer

• File Explorer

• Task Manager

What should be selected in Event Viewer to start collecting logs from ms10?

• Create Task

• Create Subscription

• Create Event

• Create Log

How can you verify that logs are being collected from ms10?

• By checking the network speed

• By viewing the logs in the Task Manager

• By checking the forwarded events in Event Viewer

• By restarting the server

What are the two types of centralized logging management available in Windows?

• Basic and advanced

• Source computer initiated and collector initiated

• Manual and automatic

• Local and remote

Is centralized logging enabled by default in Windows?

• Yes, it is enabled by default

• Yes, but only on certain versions

• No, it must be enabled manually

• No, it is not available in Windows

Why is centralized logging crucial for organizations?

• To improve internet speed

• To comply with regulations and monitor system health

• To reduce electricity consumption

• To increase storage capacity