Question

Most operating systems include a logging and auditing facility. To set the security auditing policies in Windows, navigate to Windows: Administrative Tools> Local Security Policy> Local Policies> Audit Policy. You will see that Windows can record successful and failed attempts to log on, access resources, and other potentially sensitive operations. You can enable auditing for a specific resource by opening its properties sheet to the Security tab, selecting Advanced, and then the Auditing tab. To review the security log, navigate to Windows: Administrative Tools> Event Viewer. You will see the security log, as well as logs that contain application error and system error reports. Review the settings and logs on your computer. In a 2- to 3-page report, address the following: Your main findings, especially situations you want to investigate Auditing settings you would like to modify Additional information you find helpful in the logs Suggestions to improve the audit and logging user interface Research the Windows Management Interface (WMI). How could WMI help you with some of the changes you have proposed?

Answer 1

Hi According to your question I'm posting my answer if you have any doubt please comment on the same.

We have different different Levels in for  Windows Management Interface (WMI).

Levels are as mentioned below.

To modify and edit different different level's you need to log in as Administrator.

Review Log:

WMI tasks for event logs obtain event data from event log files and perform operations like back up and clearing log files.

You can take a back of Review log as many as times you want and you can decide the interval or you can schedule the automatic logsgeneration.

WMI Diagnosis Tool is a VBScript based-tool its being used for testing, validating, and analyzing WMI issues. This tool can collects data from WMI installations on all Operating Systems at any or no service pack level.