Protect Digital Evidence, Documentation, and the Chain of Custody

Complete Lab 9 in the lab manual. This assignment uses the Virtual Security Cloud Lab (VSCL) provided by J&B Learning. Instructions for this assignment can be found in the lab manual, pages 135-148.

In the lab for this module, you will learn how to perform security audits and collect evidence using applications and tools running on Windows Server 2008. You will begin by accessing the Windows Event Viewer and identifying failed logon attempts, which could indicate a possible intrusion by an unauthorized user. You will create a Windows Event Viewer report listing the failed login attempts and use the report to explain containment and remediation steps. Then you will generate your own errors by attacking the Windows server. You will review the IIS logs to find those errors and recommend remediation steps.`