Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Security
  4. Logs\scesrv.log
LogRisk: Caution

Logs\scesrv.log C:\Windows\Security\Logs\scesrv.log

scesrv.log: secedit log (/analyze, /configure, /export, /import), rewritten at each run; shows the security settings that could not be applied.

Updated on By AltF4 Formation

What it’s for

scesrv.log is the default output of secedit, the local security configuration and analysis tool: without a /log option, secedit /analyze, /configure, /export and /import write their result here. It is rewritten on every run, so it only keeps the last pass.

What it contains

  • Results grouped by policy type: account policy, user rights, security options, services, files, Registry.
  • For each setting that failed, the associated Windows error (for example an account or group not found in a user right).
  • A closing line saying whether processing ended successfully or with errors.

Risks and best practices

  • Read it right after a secedit /configure: the next run overwrites it. To keep a trace, give an output file with /log.
  • Group Policy security processing errors correlate with the Application log (source SceCli: 1704 for a successful application, 1202 for a failure); read both.
  • Account and group names quoted in it can identify your organization: review before sharing.

Useful commands

Fenêtre de terminal
:: Configure with a separate log (as administrator)
secedit /configure /db C:\Temp\test.sdb /cfg C:\Temp\template.inf /areas USER_RIGHTS /log C:\Temp\secedit-config.log


:: Analyze the machine against a template
secedit /analyze /db C:\Temp\test.sdb /cfg C:\Temp\template.inf /log C:\Temp\secedit-analyze.log
Fenêtre de terminal
# Results of a security policy application (SceCli)
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='SceCli'} -MaxEvents 20 | Select-Object TimeCreated, Id, Message


# Error lines of the last pass
Select-String -Path "$env:windir\security\logs\scesrv.log" -Pattern 'Error|Failed'

Format

Readable text file, overwritten on every secedit run.

Rotation and archiving

No rotation: the file is replaced. Copy it before running secedit again if you want to keep the result.

How to read it

Go to the section for the policy type you care about, look for error lines, then the name of the setting involved. A Windows error such as 1332 (“No mapping between account names and security IDs was done”) points to an account or group that cannot be found in a policy.

Report a mistake