User Access Logging (UAL) Forensics

[@regulator5]

You have some of the best forensic content on RUclips. Keep up the good work

[@MSUjgasmussen]

Thank you for this information! Great job as always! 👍

[@chrisclark5135]

Fantastic as always! What can we do to get an episode a week?? Haha, just kidding, but I always appreciate your content! Thanks for sharing!

[@13Cubed]

Thanks - I wish I had the time! My goal is 1 per month, but occasionally I can hit 2.

[@Emilsurf]

Great stuff!

[@PajamaJumper]

“Access” is an interesting term here. Assuming evtx logs have been cleared and we are unable to correlate, does the presence of database entries imply that a successful connection was made? Or do “attempts” also get logged?

[@13Cubed]

Doesn't necessarily indicate success -- just network connectivity being present between the hosts.

[@melvindejesus1491]

Thanks a lot.