A log tool ships with hundreds of reports and most of them will never be opened twice. That is fine. A working system runs on a handful of reports that somebody reads every week, and these five are the handful for a Windows network.
Reports are where collected logs turn into answers. EventLog Analyzer includes predefined reports for Windows activity, network devices and compliance templates, but value concentrates fast. Failed logons, lockouts, file access, privilege changes and firewall traffic cover nearly every question a small IT team actually gets asked. For each one below: what it shows, what it catches, and the honest catch, because several reports are only as good as an audit policy somebody remembered to enable.
Windows writes event 4625 every time a logon fails, and the failed logon report turns a flood of them into a pattern: one account failing from one machine is a forgotten saved password; one account failing from fifty machines, or hundreds of accounts failing from one, is an attack until proven innocent.
Read it weekly even when nothing is wrong. Knowing your normal level of failure noise is what makes the abnormal week obvious at a glance.
Event 4740 records a lockout on the domain controller that processed it, and the lockout report shows which account locked and, crucially, the caller machine that caused it. The classic story, a phone still trying the old Wi-Fi password or a service running with expired credentials, ends in minutes instead of a day of password resets.
This single report is often the one that sells the whole tool to management, because it visibly shortens a pain everyone in the office has felt.
Who opened, changed or deleted a file on the file server is event 4663 territory, and EventLog Analyzer reports on it neatly. The catch deserves capital letters: Windows only writes these events if auditing is enabled on the server and on the folders themselves. No audit policy, no events, and an empty report that looks reassuring while proving nothing.
Enable auditing on the shares that matter, accept the extra log volume honestly (this is where the sizing math grows), and test the report by deleting a test file yourself before you ever need it for a real question.
Events like 4728, a member added to a security-enabled global group, record the moments power changes hands: new Domain Admins, helpdesk group additions, service accounts granted rights. The report is short every week, and that is the point. Any line on it that nobody can explain is a finding, not a statistic.
Pair it with an alert, covered in the alert tuning guide in this series, and privilege changes become the one category you hear about in real time instead of discovering in a quarterly review.
From the firewall's syslog you get allowed and denied traffic, top talkers and VPN logon history. Read alongside the DC reports it completes stories: the external address that probed the VPN all night is the same one behind the morning's failed logon spike.
Schedule these five as a small weekly pack, delivered to whoever owns the watching job, and archive the outputs. A year of weekly packs is also quietly your audit evidence.
The video covers getting the tool installed and sources flowing. Set up these five reports the same week, while the install steps are still fresh.
▶️ Watch Full VideoAlmost always because object access auditing is not enabled on that server or on the folder. EventLog Analyzer can only report events Windows actually wrote. Enable the audit policy, set auditing on the important shares, generate a test access, and confirm the event appears.
Yes, reports in EventLog Analyzer can be scheduled and delivered by email, which is how the weekly five usually reaches the person doing the watching. A report that arrives in the inbox gets read far more reliably than one waiting behind a login.
No. The built-in PCI DSS, HIPAA, SOX and GDPR templates organise evidence for auditors. The weekly five are for running the network. You need both, but they answer to different audiences and different calendars.