Skip to content

Commit 173e02b

Browse files
brazilianscriptguybrazilianscriptguy
authored
Refactor PrintService Operational log documentation
Removed duplicate content and standardized the documentation format for the PrintService Operational log configuration. Signed-off-by: LUIZ HAMILTON ROBERTO DA SILVA <[email protected]>
1 parent fd72a70 commit 173e02b

File tree

1 file changed

+69
-218
lines changed

1 file changed

+69
-218
lines changed

‎BlueTeam-Tools/EventLogMonitoring/PrintService-Operacional-EventLogs.md‎

Lines changed: 69 additions & 218 deletions
Original file line numberDiff line numberDiff line change
@@ -1,246 +1,97 @@
1-
# Configuring Windows Event Log for PrintService Operational Log
2-
3-
## .SYNOPSIS
4-
5-
Configures Windows Event Log settings for the PrintService Operational log.
6-
7-
## .DESCRIPTION
8-
9-
This registry file automates the configuration of the Windows Event Log for the PrintService Operational channel. It sets parameters such as `AutoBackupLogFiles`, `Flags`, log file location, maximum log size, and retention policy to ensure efficient logging and management of print services.
10-
11-
## .AUTHOR
12-
13-
Luiz Hamilton Silva - @brazilianscriptguy
14-
15-
## .VERSION
16-
17-
Last Updated: November 26, 2024
18-
19-
## .NOTES
20-
21-
- Ensure that the specified log file path (`"File"`) exists and is accessible.
22-
- This configuration is essential for maintaining and managing print service logs efficiently.
23-
- Apply the `PrintService-Operacional-EventLogs.reg` file with administrative privileges to ensure successful registry modifications.
24-
25-
## Deployment Instructions
26-
27-
### 1. Save the `PrintService-Operacional-EventLogs.reg` File
28-
29-
Save the registry configurations provided above into a file named `PrintService-Operacional-EventLogs.reg`.
1+
## What’s repeated (and why)
302

31-
### 2. Store the `.reg` File Securely
3+
Yes — you have **the same content twice**, just in two formats:
324

33-
Place the `PrintService-Operacional-EventLogs.reg` file in a **shared network location** accessible by all target machines. Ensure that the share permissions allow **read access** for the **Authenticated Users** group or the specific accounts that will apply the registry settings.
5+
- **Markdown section** (starts with `# Configuring Windows Event Log...`)
6+
- **HTML section** (starts with `<div><h1>🖨️ Configuring Windows Event Log...`)
347

35-
### 3. Deploy via Group Policy Object (GPO)
8+
They repeat the same fields:
369

37-
#### a. Open Group Policy Management Console (GPMC)
10+
- Title / Synopsis / Description / Author / Version / Notes
11+
- Deployment instructions (steps 1–6)
12+
- Best practices and final notes
13+
- Closing paragraph
3814

39-
- Press `Win + R`, type `gpmc.msc`, and press **Enter**.
15+
So the “repeatable information” is not small redundancy inside the Markdown; it’s a **full duplication** because both Markdown and HTML versions were included.
4016

41-
#### b. Create or Edit a GPO
42-
43-
- **Right-click** on the desired **Organizational Unit (OU)**.
44-
- Select **"Create a GPO in this domain, and Link it here..."** or **edit** an existing GPO.
45-
46-
#### c. Navigate to Preferences
47-
48-
- Go to `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`.
49-
50-
#### d. Create New Registry Items
17+
---
5118

52-
For each registry value defined in the `PrintService-Operacional-EventLogs.reg` file, create a corresponding registry item in the GPO:
19+
## Recommended revision: keep ONE format (Markdown) and remove the HTML block
5320

54-
1. **Right-click** on **Registry** and select **"New"** → **"Registry Item"**.
21+
Below is a cleaned, non-duplicated Markdown-only version (same meaning, tighter wording, and no repeated blocks):
5522

56-
2. **Configure the Registry Item**:
23+
```markdown
24+
# Configuring Windows Event Log for PrintService Operational Log
5725

58-
- **Action**: Select **"Update"**.
59-
- **Hive**: Select **"HKEY_LOCAL_MACHINE"**.
60-
- **Key Path**: Enter `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`.
61-
- **Value Name and Type**:
62-
- **AutoBackupLogFiles**: `DWORD` = `1`
63-
- **Flags**: `DWORD` = `1`
64-
- **File**: `REG_SZ` = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
65-
- **MaxSize**: `DWORD` = `09270000`
66-
- **MaxSizeUpper**: `DWORD` = `00000000`
67-
- **Retention**: `DWORD` = `ffffffff`
26+
## Synopsis
27+
Configures Windows Event Log settings for the **Microsoft-Windows-PrintService/Operational** channel.
6828

69-
3. **Repeat** the above steps for each registry value.
29+
## Description
30+
This `.reg` configuration automates key Event Log parameters such as `AutoBackupLogFiles`, `Flags`, log file path (`File`), maximum size (`MaxSize` / `MaxSizeUpper`), and retention (`Retention`) to support reliable PrintService logging.
7031

71-
#### e. Apply and Close
32+
## Author
33+
Luiz Hamilton Silva — @brazilianscriptguy
7234

73-
After configuring all registry values, click **"OK"** to save the settings. Then, click **"Apply"** and **"OK"** to close the GPO editor.
35+
## Version
36+
Last Updated: November 26, 2024
7437

75-
### 4. Force Group Policy Update
38+
## Notes
39+
- Ensure the target log path (value `File`) exists and is reachable by the system.
40+
- Apply the `.reg` with administrative privileges (or deploy via GPO) to ensure registry changes succeed.
7641

77-
On target machines, expedite the policy application by running:
42+
## Deployment Instructions
7843

44+
### 1) Save the `.reg` file
45+
Save the provided registry content as:
46+
`PrintService-Operacional-EventLogs.reg`
47+
48+
### 2) Store it in a shared location
49+
Place the file on a shared path accessible to target machines (read access for the accounts applying the change).
50+
51+
### 3) Deploy via Group Policy Object (GPO)
52+
1. Open **GPMC** (`gpmc.msc`)
53+
2. Create/edit a GPO linked to the target OU
54+
3. Go to: `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`
55+
4. Create Registry Items with:
56+
- **Action:** Update
57+
- **Hive:** `HKEY_LOCAL_MACHINE`
58+
- **Key Path:** `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`
59+
- **Values:**
60+
- `AutoBackupLogFiles` (DWORD) = `1`
61+
- `Flags` (DWORD) = `1`
62+
- `File` (REG_SZ) = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
63+
- `MaxSize` (DWORD) = `09270000`
64+
- `MaxSizeUpper` (DWORD) = `00000000`
65+
- `Retention` (DWORD) = `ffffffff`
66+
67+
### 4) Force policy update
7968
```powershell
8069
gpupdate /force
8170
```
71+
(or reboot)
8272

83-
Alternatively, restart the machines to allow GPO to apply the settings during startup.
73+
### 5) Verify registry
74+
Check:
75+
`HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`
8476

85-
### 5. Verify Registry Changes
77+
### 6) Monitor logs
78+
Confirm the `.evtx` is being created/updated at:
79+
`L:\Microsoft-Windows-PrintService-Operational\`
8680

87-
After deployment, on a target machine, open **Registry Editor** (`regedit`) and navigate to:
88-
89-
```
90-
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational
81+
## Best Practices
82+
- Backup registry / test on a single machine first.
83+
- Validate that `L:` is consistently available on all endpoints (mapping/permissions).
84+
- Secure the log storage location against tampering.
9185
```
9286

93-
Ensure that all the specified values are correctly set.
94-
95-
### 6. Monitor Logs
96-
97-
Check the log file location (`L:\Microsoft-Windows-PrintService-Operational\`) to verify that the `Microsoft-Windows-PrintService-Operational.evtx` log file is being created and updated as per the configurations.
98-
99-
## Best Practices and Final Notes
87+
---
10088

101-
- **Backup Registry Before Changes**:
102-
- Always create a backup of the registry before applying changes, especially in a production environment.
103-
104-
- **Test on a Single Machine**:
105-
- Before wide-scale deployment, apply the `.reg` file to a single test machine to ensure it behaves as expected.
89+
## One important consistency note (optional but recommended)
90+
Your key path alternates between:
10691

107-
- **Ensure Network Share Accessibility**:
108-
- Verify that the drive letter `L:` is correctly mapped on all target machines and that the specified path exists.
109-
110-
- **Monitor Event Logs**:
111-
- Regularly monitor the Application Event Logs for any errors related to the registry changes or the PrintService Operational logs.
112-
113-
- **Documentation**:
114-
- Maintain documentation of all registry changes for future reference and troubleshooting.
115-
116-
- **Security Considerations**:
117-
- Ensure that the network share containing the log files is secured and accessible only by authorized users to prevent unauthorized access or tampering.
92+
- `Microsoft-Windows-PrintService/Operational` (with `/`)
93+
- `Microsoft-Windows-PrintService\Operational` (with `\`)
11894

119-
---
95+
In Windows Registry paths, it’s typically shown with backslashes. If you want maximum clarity, standardize the documentation to **one** form (I’d use `Microsoft-Windows-PrintService/Operational` only when referring to the *Event Log channel name*, and `...\Microsoft-Windows-PrintService\Operational` when referring to the *registry key path*).
12096

121-
*By incorporating this well-documented `PrintService-Operacional-EventLogs.reg` file into your deployment strategy, you ensure consistent and efficient configuration of the PrintService Operational event logs across all target machines in your network.*
122-
<div>
123-
<h1>🖨️ Configuring Windows Event Log for PrintService Operational Log</h1>
124-
125-
<h2>📝 SYNOPSIS</h2>
126-
<p>Configures Windows Event Log settings for the <strong>PrintService Operational</strong> log.</p>
127-
128-
<h2>📖 DESCRIPTION</h2>
129-
<p>
130-
This registry file automates the configuration of the Windows Event Log for the
131-
<strong>PrintService Operational</strong> channel. It sets parameters such as
132-
<code>AutoBackupLogFiles</code>, <code>Flags</code>, log file location, maximum log size,
133-
and retention policy to ensure efficient logging and management of print services.
134-
</p>
135-
136-
<h2>👤 AUTHOR</h2>
137-
<p><strong>Luiz Hamilton Silva</strong> - @brazilianscriptguy</p>
138-
139-
<h2>📌 VERSION</h2>
140-
<p><strong>Last Updated:</strong> November 26, 2024</p>
141-
142-
<h2>📝 NOTES</h2>
143-
<ul>
144-
<li>Ensure that the specified log file path (<code>"File"</code>) exists and is accessible.</li>
145-
<li>This configuration is essential for maintaining and managing print service logs efficiently.</li>
146-
<li>Apply the <code>PrintService-Operacional-EventLogs.reg</code> file with administrative privileges
147-
to ensure successful registry modifications.</li>
148-
</ul>
149-
150-
<hr />
151-
152-
<h2>🚀 Deployment Instructions</h2>
153-
154-
<h3>1️⃣ Save the <code>PrintService-Operacional-EventLogs.reg</code> File</h3>
155-
<p>Save the registry configurations provided above into a file named
156-
<code>PrintService-Operacional-EventLogs.reg</code>.
157-
</p>
158-
159-
<h3>2️⃣ Store the <code>.reg</code> File Securely</h3>
160-
<p>
161-
Place the <code>PrintService-Operacional-EventLogs.reg</code> file in a
162-
<strong>shared network location</strong> accessible by all target machines.
163-
Ensure that the share permissions allow <strong>read access</strong> for the
164-
<code>Authenticated Users</code> group or specific accounts that will apply the registry settings.
165-
</p>
166-
167-
<h3>3️⃣ Deploy via Group Policy Object (GPO)</h3>
168-
169-
<h4>➡️ Open Group Policy Management Console (GPMC)</h4>
170-
<ul>
171-
<li>Press <kbd>Win + R</kbd>, type <code>gpmc.msc</code>, and press <kbd>Enter</kbd>.</li>
172-
</ul>
173-
174-
<h4>➡️ Create or Edit a GPO</h4>
175-
<ul>
176-
<li><strong>Right-click</strong> on the desired <strong>Organizational Unit (OU)</strong>.</li>
177-
<li>Select <strong>"Create a GPO in this domain, and Link it here..."</strong> or edit an existing GPO.</li>
178-
</ul>
179-
180-
<h4>➡️ Navigate to Preferences</h4>
181-
<ul>
182-
<li>Go to <code>Computer Configuration</code> → <code>Preferences</code> → <code>Windows Settings</code> → <code>Registry</code>.</li>
183-
</ul>
184-
185-
<h4>➡️ Create New Registry Items</h4>
186-
<p>For each registry value defined in the <code>PrintService-Operacional-EventLogs.reg</code> file,
187-
create a corresponding registry item in the GPO:
188-
</p>
189-
<ol>
190-
<li><strong>Right-click</strong> on <strong>Registry</strong> and select <strong>"New" → "Registry Item"</strong>.</li>
191-
<li><strong>Configure the Registry Item:</strong></li>
192-
<ul>
193-
<li><strong>Action:</strong> Select <strong>"Update"</strong>.</li>
194-
<li><strong>Hive:</strong> Select <code>"HKEY_LOCAL_MACHINE"</code>.</li>
195-
<li><strong>Key Path:</strong> Enter <code>SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational</code>.</li>
196-
<li><strong>Value Name and Type:</strong></li>
197-
<ul>
198-
<li><code>AutoBackupLogFiles</code>: <code>DWORD</code> = <code>1</code></li>
199-
<li><code>Flags</code>: <code>DWORD</code> = <code>1</code></li>
200-
<li><code>File</code>: <code>REG_SZ</code> = <code>L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx</code></li>
201-
<li><code>MaxSize</code>: <code>DWORD</code> = <code>09270000</code></li>
202-
<li><code>MaxSizeUpper</code>: <code>DWORD</code> = <code>00000000</code></li>
203-
<li><code>Retention</code>: <code>DWORD</code> = <code>ffffffff</code></li>
204-
</ul>
205-
</ul>
206-
<li><strong>Repeat</strong> the above steps for each registry value.</li>
207-
</ol>
208-
209-
<h4>➡️ Apply and Close</h4>
210-
<ul>
211-
<li>After configuring all registry values, click <strong>"OK"</strong> to save the settings.</li>
212-
<li>Click <strong>"Apply"</strong> and <strong>"OK"</strong> to close the GPO editor.</li>
213-
</ul>
214-
215-
<h3>4️⃣ Force Group Policy Update</h3>
216-
<p>On target machines, expedite the policy application by running:</p>
217-
<pre><code>gpupdate /force</code></pre>
218-
<p>Alternatively, restart the machines to allow GPO to apply the settings during startup.</p>
219-
220-
<h3>5️⃣ Verify Registry Changes</h3>
221-
<p>After deployment, on a target machine, open <strong>Registry Editor</strong> (<code>regedit</code>) and navigate to:</p>
222-
<pre><code>HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational</code></pre>
223-
<p>Ensure that all the specified values are correctly set.</p>
224-
225-
<h3>6️⃣ Monitor Logs</h3>
226-
<p>Check the log file location (<code>L:\Microsoft-Windows-PrintService-Operational\</code>)
227-
to verify that the <code>Microsoft-Windows-PrintService-Operational.evtx</code> log file is
228-
being created and updated as per the configurations.
229-
</p>
230-
231-
<hr />
232-
233-
<h2>✅ Best Practices and Final Notes</h2>
234-
<ul>
235-
<li><strong>Backup Registry Before Changes:</strong> Always create a backup before applying changes, especially in production environments.</li>
236-
<li><strong>Test on a Single Machine:</strong> Before wide-scale deployment, apply the <code>.reg</code> file to a single test machine.</li>
237-
<li><strong>Ensure Network Share Accessibility:</strong> Verify that the drive letter <code>L:</code> is correctly mapped and that the specified path exists.</li>
238-
<li><strong>Monitor Event Logs:</strong> Regularly check the Application Event Logs for any errors related to the registry changes.</li>
239-
<li><strong>Documentation:</strong> Maintain a record of all registry changes for future reference and troubleshooting.</li>
240-
<li><strong>Security Considerations:</strong> Ensure that the network share containing log files is secured and accessible only by authorized users.</li>
241-
</ul>
242-
243-
<p><em>By incorporating this well-documented <code>PrintService-Operacional-EventLogs.reg</code> file into your deployment strategy,
244-
you ensure consistent and efficient configuration of the PrintService Operational event logs across all target machines
245-
in your network.</em></p>
246-
</div>
97+
If you tell me which one your `.reg` actually uses, I’ll align the text precisely to match it.

0 commit comments

Comments
 (0)