Skip to content

Commit d6fa438

Browse files
brazilianscriptguybrazilianscriptguy
authored
Update PrintService-Operacional-EventLogs.md
Signed-off-by: LUIZ HAMILTON ROBERTO DA SILVA <[email protected]>
1 parent 44e2b27 commit d6fa438

File tree

1 file changed

+219
-48
lines changed

1 file changed

+219
-48
lines changed

‎BlueTeam-Tools/EventLogMonitoring/PrintService-Operacional-EventLogs.md‎

Lines changed: 219 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,246 @@
1-
# 🖨️ Configuring Windows Event Log for PrintService Operational Log
1+
# Configuring Windows Event Log for PrintService Operational Log
22

3-
## 📝 Synopsis
3+
## .SYNOPSIS
44

5-
Configures Windows Event Log settings for the **PrintService Operational** log.
5+
Configures Windows Event Log settings for the PrintService Operational log.
66

7-
## 📖 Description
7+
## .DESCRIPTION
88

9-
This registry file automates the configuration of the Windows Event Log for the **PrintService Operational** channel. It sets parameters such as `AutoBackupLogFiles`, `Flags`, log file location, maximum log size, and retention policy to ensure efficient logging and management of print services.
9+
This registry file automates the configuration of the Windows Event Log for the PrintService Operational channel. It sets parameters such as `AutoBackupLogFiles`, `Flags`, log file location, maximum log size, and retention policy to ensure efficient logging and management of print services.
1010

11-
## 👤 Author
11+
## .AUTHOR
1212

13-
**Luiz Hamilton Silva** - [@brazilianscriptguy](https://github.com/brazilianscriptguy)
13+
Luiz Hamilton Silva - @brazilianscriptguy
1414

15-
## 📌 Version
15+
## .VERSION
1616

17-
**Last Updated:** November 26, 2024
17+
Last Updated: November 26, 2024
1818

19-
## 📝 Notes
19+
## .NOTES
2020

21-
- Ensure that the specified log file path (`File`) exists and is accessible
22-
- This configuration is essential for maintaining and managing print service logs efficiently
23-
- Apply the `PrintService-Operacional-EventLogs.reg` file with administrative privileges to ensure successful registry modifications
21+
- Ensure that the specified log file path (`"File"`) exists and is accessible.
22+
- This configuration is essential for maintaining and managing print service logs efficiently.
23+
- Apply the `PrintService-Operacional-EventLogs.reg` file with administrative privileges to ensure successful registry modifications.
2424

25-
---
25+
## Deployment Instructions
26+
27+
### 1. Save the `PrintService-Operacional-EventLogs.reg` File
28+
29+
Save the registry configurations provided above into a file named `PrintService-Operacional-EventLogs.reg`.
2630

27-
## 🚀 Deployment Instructions
31+
### 2. Store the `.reg` File Securely
2832

29-
### 1️⃣ Save the Registry File
33+
Place the `PrintService-Operacional-EventLogs.reg` file in a **shared network location** accessible by all target machines. Ensure that the share permissions allow **read access** for the **Authenticated Users** group or the specific accounts that will apply the registry settings.
3034

31-
Save the registry configurations into a file named `PrintService-Operacional-EventLogs.reg`.
35+
### 3. Deploy via Group Policy Object (GPO)
3236

33-
### 2️⃣ Store Securely
37+
#### a. Open Group Policy Management Console (GPMC)
3438

35-
Place the `PrintService-Operacional-EventLogs.reg` file in a **shared network location** accessible by all target machines. Ensure that the share permissions allow **read access** for the `Authenticated Users` group or specific accounts that will apply the registry settings.
39+
- Press `Win + R`, type `gpmc.msc`, and press **Enter**.
3640

37-
### 3️⃣ Deploy via Group Policy Object (GPO)
41+
#### b. Create or Edit a GPO
3842

39-
#### Open Group Policy Management Console (GPMC)
40-
- Press `Win + R`, type `gpmc.msc`, and press `Enter`
43+
- **Right-click** on the desired **Organizational Unit (OU)**.
44+
- Select **"Create a GPO in this domain, and Link it here..."** or **edit** an existing GPO.
4145

42-
#### Create or Edit a GPO
43-
- **Right-click** on the desired **Organizational Unit (OU)**
44-
- Select **"Create a GPO in this domain, and Link it here..."** or edit an existing GPO
46+
#### c. Navigate to Preferences
4547

46-
#### Navigate to Preferences
47-
- Go to `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`
48+
- Go to `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`.
49+
50+
#### d. Create New Registry Items
4851

49-
#### Create New Registry Items
5052
For each registry value defined in the `PrintService-Operacional-EventLogs.reg` file, create a corresponding registry item in the GPO:
5153

52-
1. **Right-click** on **Registry** and select **"New" → "Registry Item"**
53-
2. **Configure the Registry Item:**
54-
- **Action:** Select **"Update"**
55-
- **Hive:** Select `HKEY_LOCAL_MACHINE`
56-
- **Key Path:** Enter `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`
57-
- **Value Name and Type:**
58-
- `AutoBackupLogFiles`: `DWORD` = `1`
59-
- `Flags`: `DWORD` = `1`
60-
- `File`: `REG_SZ` = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
61-
- `MaxSize`: `DWORD` = `09270000`
62-
- `MaxSizeUpper`: `DWORD` = `00000000`
63-
- `Retention`: `DWORD` = `ffffffff`
64-
3. **Repeat** the above steps for each registry value
65-
66-
#### Apply and Close
67-
- After configuring all registry values, click **"OK"** to save the settings
68-
- Click **"Apply"** and **"OK"** to close the GPO editor
69-
70-
### 4️⃣ Force Group Policy Update
54+
1. **Right-click** on **Registry** and select **"New"** → **"Registry Item"**.
55+
56+
2. **Configure the Registry Item**:
57+
58+
- **Action**: Select **"Update"**.
59+
- **Hive**: Select **"HKEY_LOCAL_MACHINE"**.
60+
- **Key Path**: Enter `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`.
61+
- **Value Name and Type**:
62+
- **AutoBackupLogFiles**: `DWORD` = `1`
63+
- **Flags**: `DWORD` = `1`
64+
- **File**: `REG_SZ` = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
65+
- **MaxSize**: `DWORD` = `09270000`
66+
- **MaxSizeUpper**: `DWORD` = `00000000`
67+
- **Retention**: `DWORD` = `ffffffff`
68+
69+
3. **Repeat** the above steps for each registry value.
70+
71+
#### e. Apply and Close
72+
73+
After configuring all registry values, click **"OK"** to save the settings. Then, click **"Apply"** and **"OK"** to close the GPO editor.
74+
75+
### 4. Force Group Policy Update
7176

7277
On target machines, expedite the policy application by running:
7378

74-
```cmd
79+
```powershell
7580
gpupdate /force
81+
```
82+
83+
Alternatively, restart the machines to allow GPO to apply the settings during startup.
84+
85+
### 5. Verify Registry Changes
86+
87+
After deployment, on a target machine, open **Registry Editor** (`regedit`) and navigate to:
88+
89+
```
90+
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational
91+
```
92+
93+
Ensure that all the specified values are correctly set.
94+
95+
### 6. Monitor Logs
96+
97+
Check the log file location (`L:\Microsoft-Windows-PrintService-Operational\`) to verify that the `Microsoft-Windows-PrintService-Operational.evtx` log file is being created and updated as per the configurations.
98+
99+
## Best Practices and Final Notes
100+
101+
- **Backup Registry Before Changes**:
102+
- Always create a backup of the registry before applying changes, especially in a production environment.
103+
104+
- **Test on a Single Machine**:
105+
- Before wide-scale deployment, apply the `.reg` file to a single test machine to ensure it behaves as expected.
106+
107+
- **Ensure Network Share Accessibility**:
108+
- Verify that the drive letter `L:` is correctly mapped on all target machines and that the specified path exists.
109+
110+
- **Monitor Event Logs**:
111+
- Regularly monitor the Application Event Logs for any errors related to the registry changes or the PrintService Operational logs.
112+
113+
- **Documentation**:
114+
- Maintain documentation of all registry changes for future reference and troubleshooting.
115+
116+
- **Security Considerations**:
117+
- Ensure that the network share containing the log files is secured and accessible only by authorized users to prevent unauthorized access or tampering.
118+
119+
---
120+
121+
*By incorporating this well-documented `PrintService-Operacional-EventLogs.reg` file into your deployment strategy, you ensure consistent and efficient configuration of the PrintService Operational event logs across all target machines in your network.*
122+
<div>
123+
<h1>🖨️ Configuring Windows Event Log for PrintService Operational Log</h1>
124+
125+
<h2>📝 SYNOPSIS</h2>
126+
<p>Configures Windows Event Log settings for the <strong>PrintService Operational</strong> log.</p>
127+
128+
<h2>📖 DESCRIPTION</h2>
129+
<p>
130+
This registry file automates the configuration of the Windows Event Log for the
131+
<strong>PrintService Operational</strong> channel. It sets parameters such as
132+
<code>AutoBackupLogFiles</code>, <code>Flags</code>, log file location, maximum log size,
133+
and retention policy to ensure efficient logging and management of print services.
134+
</p>
135+
136+
<h2>👤 AUTHOR</h2>
137+
<p><strong>Luiz Hamilton Silva</strong> - @brazilianscriptguy</p>
138+
139+
<h2>📌 VERSION</h2>
140+
<p><strong>Last Updated:</strong> November 26, 2024</p>
141+
142+
<h2>📝 NOTES</h2>
143+
<ul>
144+
<li>Ensure that the specified log file path (<code>"File"</code>) exists and is accessible.</li>
145+
<li>This configuration is essential for maintaining and managing print service logs efficiently.</li>
146+
<li>Apply the <code>PrintService-Operacional-EventLogs.reg</code> file with administrative privileges
147+
to ensure successful registry modifications.</li>
148+
</ul>
149+
150+
<hr />
151+
152+
<h2>🚀 Deployment Instructions</h2>
153+
154+
<h3>1️⃣ Save the <code>PrintService-Operacional-EventLogs.reg</code> File</h3>
155+
<p>Save the registry configurations provided above into a file named
156+
<code>PrintService-Operacional-EventLogs.reg</code>.
157+
</p>
158+
159+
<h3>2️⃣ Store the <code>.reg</code> File Securely</h3>
160+
<p>
161+
Place the <code>PrintService-Operacional-EventLogs.reg</code> file in a
162+
<strong>shared network location</strong> accessible by all target machines.
163+
Ensure that the share permissions allow <strong>read access</strong> for the
164+
<code>Authenticated Users</code> group or specific accounts that will apply the registry settings.
165+
</p>
166+
167+
<h3>3️⃣ Deploy via Group Policy Object (GPO)</h3>
168+
169+
<h4>➡️ Open Group Policy Management Console (GPMC)</h4>
170+
<ul>
171+
<li>Press <kbd>Win + R</kbd>, type <code>gpmc.msc</code>, and press <kbd>Enter</kbd>.</li>
172+
</ul>
173+
174+
<h4>➡️ Create or Edit a GPO</h4>
175+
<ul>
176+
<li><strong>Right-click</strong> on the desired <strong>Organizational Unit (OU)</strong>.</li>
177+
<li>Select <strong>"Create a GPO in this domain, and Link it here..."</strong> or edit an existing GPO.</li>
178+
</ul>
179+
180+
<h4>➡️ Navigate to Preferences</h4>
181+
<ul>
182+
<li>Go to <code>Computer Configuration</code> → <code>Preferences</code> → <code>Windows Settings</code> → <code>Registry</code>.</li>
183+
</ul>
184+
185+
<h4>➡️ Create New Registry Items</h4>
186+
<p>For each registry value defined in the <code>PrintService-Operacional-EventLogs.reg</code> file,
187+
create a corresponding registry item in the GPO:
188+
</p>
189+
<ol>
190+
<li><strong>Right-click</strong> on <strong>Registry</strong> and select <strong>"New" → "Registry Item"</strong>.</li>
191+
<li><strong>Configure the Registry Item:</strong></li>
192+
<ul>
193+
<li><strong>Action:</strong> Select <strong>"Update"</strong>.</li>
194+
<li><strong>Hive:</strong> Select <code>"HKEY_LOCAL_MACHINE"</code>.</li>
195+
<li><strong>Key Path:</strong> Enter <code>SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational</code>.</li>
196+
<li><strong>Value Name and Type:</strong></li>
197+
<ul>
198+
<li><code>AutoBackupLogFiles</code>: <code>DWORD</code> = <code>1</code></li>
199+
<li><code>Flags</code>: <code>DWORD</code> = <code>1</code></li>
200+
<li><code>File</code>: <code>REG_SZ</code> = <code>L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx</code></li>
201+
<li><code>MaxSize</code>: <code>DWORD</code> = <code>09270000</code></li>
202+
<li><code>MaxSizeUpper</code>: <code>DWORD</code> = <code>00000000</code></li>
203+
<li><code>Retention</code>: <code>DWORD</code> = <code>ffffffff</code></li>
204+
</ul>
205+
</ul>
206+
<li><strong>Repeat</strong> the above steps for each registry value.</li>
207+
</ol>
208+
209+
<h4>➡️ Apply and Close</h4>
210+
<ul>
211+
<li>After configuring all registry values, click <strong>"OK"</strong> to save the settings.</li>
212+
<li>Click <strong>"Apply"</strong> and <strong>"OK"</strong> to close the GPO editor.</li>
213+
</ul>
214+
215+
<h3>4️⃣ Force Group Policy Update</h3>
216+
<p>On target machines, expedite the policy application by running:</p>
217+
<pre><code>gpupdate /force</code></pre>
218+
<p>Alternatively, restart the machines to allow GPO to apply the settings during startup.</p>
219+
220+
<h3>5️⃣ Verify Registry Changes</h3>
221+
<p>After deployment, on a target machine, open <strong>Registry Editor</strong> (<code>regedit</code>) and navigate to:</p>
222+
<pre><code>HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational</code></pre>
223+
<p>Ensure that all the specified values are correctly set.</p>
224+
225+
<h3>6️⃣ Monitor Logs</h3>
226+
<p>Check the log file location (<code>L:\Microsoft-Windows-PrintService-Operational\</code>)
227+
to verify that the <code>Microsoft-Windows-PrintService-Operational.evtx</code> log file is
228+
being created and updated as per the configurations.
229+
</p>
230+
231+
<hr />
232+
233+
<h2>✅ Best Practices and Final Notes</h2>
234+
<ul>
235+
<li><strong>Backup Registry Before Changes:</strong> Always create a backup before applying changes, especially in production environments.</li>
236+
<li><strong>Test on a Single Machine:</strong> Before wide-scale deployment, apply the <code>.reg</code> file to a single test machine.</li>
237+
<li><strong>Ensure Network Share Accessibility:</strong> Verify that the drive letter <code>L:</code> is correctly mapped and that the specified path exists.</li>
238+
<li><strong>Monitor Event Logs:</strong> Regularly check the Application Event Logs for any errors related to the registry changes.</li>
239+
<li><strong>Documentation:</strong> Maintain a record of all registry changes for future reference and troubleshooting.</li>
240+
<li><strong>Security Considerations:</strong> Ensure that the network share containing log files is secured and accessible only by authorized users.</li>
241+
</ul>
242+
243+
<p><em>By incorporating this well-documented <code>PrintService-Operacional-EventLogs.reg</code> file into your deployment strategy,
244+
you ensure consistent and efficient configuration of the PrintService Operational event logs across all target machines
245+
in your network.</em></p>
246+
</div>

0 commit comments

Comments
 (0)