Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Security.evtx
LogRisk: Caution

Security.evtx C:\Windows\System32\winevt\Logs\Security.evtx

Security log: audit events (sign-ins, object access) driven by the audit policy.

Updated on By AltF4 Formation

What it’s for

Security.evtx is the Windows audit log: it holds only what the audit policy asks to trace. It is the source for who signed in, who changed what on an account or group, and whether someone cleared their tracks. What it shares with the other .evtx files is on the page for the winevt\Logs folder.

What it contains

  • Successful and failed sign-ins (for example 4624 and 4625).
  • Special privilege assignments (4672).
  • Process creation, when the matching audit setting is enabled (4688).
  • Account and group changes, such as 4720 (account created), 4740 (account locked out) or 4732 (added to a local group), and file and Registry access, depending on the policy.
  • The clearing of the log itself (event 1102).

Risks and best practices

  • Clearing this log leaves a trace: event 1102, the first thing any auditor looks for. In regulated environments retention is often mandatory. Export or forward events (event collection, SIEM) before any purge.
  • Size the maximum according to audit volume: a full log that overwrites events loses evidence.
  • Reading it requires elevated rights (administrator or the Event Log Readers group). Copies contain account names, machine names and addresses, so protect them.

Useful commands

Fenêtre de terminal
# Latest failed sign-ins (as administrator)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20


# Back up a copy of the log (as administrator)
wevtutil epl Security "$env:USERPROFILE\Desktop\Security-backup.evtx"

Format

Binary XML file (.evtx). Each event shows its ID, the account involved, the source machine and the outcome, audit success or failure.

Rotation and archiving

Maximum size and retention are set in the log properties or through Group Policy. When retention is set to “Archive the log when full”, archived files are created in the Logs folder. wevtutil gl Security shows the configuration.

How to read it

Event Viewer, Windows Logs, Security (administrator rights required). Filter by event ID. Events depend on the audit policy: if an expected event is missing, check the advanced audit policy first.

Report a mistake