DFIRHub

Windows event log ยท Security1100 The event logging service has shut down

Please note, Event Log 4609 (Computer is shutting down) doesn't get logged anymore due to this service being shut down first.

  • Security
  • 1 field
  • Security.evtx
  • Microsoft-Windows-Eventlog

Notes

  • Please note, Event Log 4609 (Computer is shutting down) doesn't get logged anymore due to this service being shut down first.
  • Therefore, 4609 never gets a chance to get logged. This log is effectively your time of computer shutdown, as a result.
  • This map likely won't log any data in PayloadData1, but at least this map will provide the Map Description column with something.

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData1%ServiceShutdown%
    • %ServiceShutdown% = /Event/UserData[@Name="ServiceShutdown"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc64rgd8-d6ef-4962-83d5-6e5wergce148}"/>
    <EventID>1100</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>103</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4020000340000000</Keywords>
    <TimeCreated SystemTime="2020-10-07 02:38:05.9085508"/>
    <EventRecordID>266791475</EventRecordID>
    <Correlation/>
    <Execution ProcessID="679" ThreadID="1234"/>
    <Channel>Security</Channel>
    <Computer>HOSTNAME</Computer>
    <Security/>
  </System>
  <UserData>
    <ServiceShutdown></ServiceShutdown>
  </UserData>
</Event>

References

4 links

Source: evtx/Maps/Security_Microsoft-Windows-Eventlog_1100.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)