# Event Logs ### DCSync Related Logs related to DCSync Credential attacks. This is a start but needs more filtering as there are tons of 4662 events. ```xml ``` ### GPO Drive Map Troubleshooting [Source](https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/scenario-guide-gpo-to-map-network-drive-doesn-t-apply-as-expected) ```xml ``` Recently installed software This will only show software related installation events that are still stored in the system event log, so be mindful of the date of the last event log entry to know how far back logs are available. ```powershell Get-WinEvent -ProviderName MsiInstaller | where id -eq 1033 | select TimeCreated,Message | Format-List ``` ### Windows IP address conflict ```xml ``` Log example: ```powershell The system detected an address conflict for IP address 10.X.Y.Z with the system having network hardware address 00-1F-FE-D8-31-00. Network operations on this system may be disrupted as a result. ``` Via PowerShell: ```powershell $query = @" "@ $ipConflictEvents = Get-WinEvent -FilterXml $query -Oldest $ipConflictEvents | Format-Table ``` ### Windows RDP-Related Event Logs [Source](https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/) Below is a consolidated XML query of all of the event ids related in the above document. I have yet to have this actually solve a problem for me as of 5/30/2024. I still need to dive into the details of the individual log entries with different types and data. ```xml ``` \#end