{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>U\u017eivatelsk\u00e9 pracovn\u00ed stanice jsou nejzraniteln\u011bj\u0161\u00ed \u010d\u00e1st\u00ed infrastruktury z hlediska informa\u010dn\u00ed bezpe\u010dnosti. U\u017eivatel\u016fm m\u016f\u017ee do pracovn\u00ed po\u0161ty p\u0159ij\u00edt e-mail, kter\u00fd vypad\u00e1 jako od bezpe\u010dn\u00e9ho zdroje, ale obsahuje odkaz na infikovanou str\u00e1nku. N\u011bkdo si mo\u017en\u00e1 st\u00e1hne u\u017eite\u010dn\u00fd pracovn\u00ed n\u00e1stroj z nezn\u00e1m\u00e9ho m\u00edsta. M\u016f\u017eeme si p\u0159edstavit des\u00edtky p\u0159\u00edpad\u016f, jak m\u016f\u017ee \u0161kodliv\u00fd software proniknout do firemn\u00edch zdroj\u016f skrze u\u017eivatele. Proto pracovn\u00ed stanice vy\u017eaduj\u00ed zv\u00fd\u0161enou pozornost a v \u010dl\u00e1nku se pod\u00edv\u00e1me na to, odkud a jak\u00e1 ud\u00e1losti by m\u011bly b\u00fdt sledov\u00e1ny pro detekci \u00fatok\u016f.<\/p>\n<p><img decoding=\"async\" alt=\"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Aby bylo mo\u017en\u00e9 detekovat \u00fatok v jeho nejran\u011bj\u0161\u00ed f\u00e1zi, existuj\u00ed ve Windows t\u0159i u\u017eite\u010dn\u00e9 zdroje ud\u00e1lost\u00ed: protokol zabezpe\u010den\u00ed, protokol syst\u00e9mov\u00e9ho monitorov\u00e1n\u00ed a protokoly Power Shell.<\/p>\n<h2>Protokol zabezpe\u010den\u00ed (Security Log)<\/h2>\n<p>\nTo je hlavn\u00ed m\u00edsto pro uchov\u00e1v\u00e1n\u00ed syst\u00e9mov\u00fdch protokol\u016f zabezpe\u010den\u00ed. Sem se zaznamen\u00e1vaj\u00ed ud\u00e1losti p\u0159ihl\u00e1\u0161en\u00ed\/odhl\u00e1\u0161en\u00ed u\u017eivatel\u016f, p\u0159\u00edstupu k objekt\u016fm, zm\u011bn politik a dal\u0161\u00edch aktivit souvisej\u00edc\u00edch se zabezpe\u010den\u00edm. Samoz\u0159ejm\u011b, pokud je nastavena odpov\u00eddaj\u00edc\u00ed politika.<\/p>\n<p><img decoding=\"async\" alt=\"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>P\u0159ehled u\u017eivatel\u016f a skupin (ud\u00e1losti 4798 a 4799).<\/b> \u0160kodliv\u00fd software na za\u010d\u00e1tku \u00fatoku \u010dasto p\u0159ehled\u00e1v\u00e1 m\u00edstn\u00ed u\u017eivatelsk\u00e9 \u00fa\u010dty a m\u00edstn\u00ed skupiny na pracovn\u00ed stanici, aby na\u0161el p\u0159ihla\u0161ovac\u00ed \u00fadaje pro sv\u00e9 temn\u00e9 \u010dinnosti. Tyto ud\u00e1losti pomohou odhalit \u0161kodliv\u00fd k\u00f3d d\u0159\u00edve, ne\u017e se posune d\u00e1l a \u0161\u00ed\u0159\u00ed se na dal\u0161\u00ed syst\u00e9my pomoc\u00ed nasb\u00edran\u00fdch dat.<\/p>\n<p><b>Vytv\u00e1\u0159en\u00ed m\u00edstn\u00edho u\u017eivatelsk\u00e9ho \u00fa\u010dtu a zm\u011bny v m\u00edstn\u00edch skupin\u00e1ch (ud\u00e1losti 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 a 5377).<\/b> \u00datok m\u016f\u017ee tak\u00e9 za\u010d\u00edt nap\u0159\u00edklad p\u0159id\u00e1n\u00edm nov\u00e9ho u\u017eivatele do skupiny m\u00edstn\u00edch administr\u00e1tor\u016f.<\/p>\n<p><b>Pokusy o p\u0159ihl\u00e1\u0161en\u00ed s m\u00edstn\u00edm u\u017eivatelsk\u00fdm \u00fa\u010dtem (ud\u00e1lost 4624).<\/b> Poctiv\u00ed u\u017eivatel\u00e9 se p\u0159ihla\u0161uj\u00ed pomoc\u00ed dom\u00e9nov\u00e9ho \u00fa\u010dtu a detekce p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed m\u00edstn\u00edho \u00fa\u010dtu m\u016f\u017ee znamenat za\u010d\u00e1tek \u00fatoku. Ud\u00e1lost 4624 zahrnuje tak\u00e9 p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed dom\u00e9nov\u00e9ho \u00fa\u010dtu, proto je t\u0159eba p\u0159i zpracov\u00e1n\u00ed ud\u00e1lost\u00ed filtrovat ud\u00e1losti, kde se dom\u00e9na li\u0161\u00ed od n\u00e1zvu pracovn\u00ed stanice.<\/p>\n<p><b>Pokus o p\u0159ihl\u00e1\u0161en\u00ed s dan\u00fdm \u00fa\u010dtem (ud\u00e1lost 4648).<\/b> Tohoto m\u016f\u017ee doj\u00edt, pokud je proces spu\u0161t\u011bn v re\u017eimu \u201eSpustit jako\u201c (run as). V b\u011b\u017en\u00e9m provozn\u00edm re\u017eimu by se to d\u00edt nem\u011blo, tak\u017ee takov\u00e9 ud\u00e1losti by m\u011bly b\u00fdt pod kontrolou.<\/p>\n<p><b>Blokace\/odblokace pracovn\u00ed stanice (ud\u00e1losti 4800-4803).<\/b> Mezi podez\u0159el\u00e9 ud\u00e1losti lze za\u0159adit jak\u00e9koliv akce, kter\u00e9 se odehr\u00e1ly na zablokovan\u00e9 pracovn\u00ed stanici.<\/p>\n<p><b>Zm\u011bny konfigurace firewallu (ud\u00e1losti 4944-4958).<\/b> Je z\u0159ejm\u00e9, \u017ee p\u0159i instalaci nov\u00e9ho softwaru mohou b\u00fdt nastaven\u00ed firewallu zm\u011bn\u011bna, co\u017e vyvol\u00e1 fale\u0161n\u00e9 poplachy. Kontrolovat takov\u00e9 zm\u011bny obvykle nen\u00ed pot\u0159eba, ale v\u011bd\u011bt o nich ur\u010dit\u011b nen\u00ed na \u0161kodu.<\/p>\n<p><b>P\u0159ipojen\u00ed za\u0159\u00edzen\u00ed Plug\u2019n\u2019play (ud\u00e1lost 6416, pouze pro Windows 10).<\/b> Na to je d\u016fle\u017eit\u00e9 d\u00e1vat pozor, pokud u\u017eivatel\u00e9 obvykle nep\u0159ipojuj\u00ed nov\u00e1 za\u0159\u00edzen\u00ed k pracovn\u00ed stanici, a najednou \u2014 p\u0159ipojili.<\/p>\n<p>Windows obsahuje 9 kategori\u00ed auditu a 50 podkategori\u00ed pro jemn\u00e9 lad\u011bn\u00ed. Minim\u00e1ln\u00ed sada podkategori\u00ed, kterou je dobr\u00e9 zapnout v nastaven\u00edch:<\/p>\n<p><b>P\u0159ihl\u00e1\u0161en\u00ed\/odhl\u00e1\u0161en\u00ed<\/b><\/p>\n<ul>\n<li>P\u0159ihl\u00e1\u0161en\u00ed;<\/li>\n<li>Odhl\u00e1\u0161en\u00ed;<\/li>\n<li>Zamknut\u00ed \u00fa\u010dtu;<\/li>\n<li>Jin\u00e9 ud\u00e1losti p\u0159ihl\u00e1\u0161en\u00ed\/odhl\u00e1\u0161en\u00ed.<\/li>\n<\/ul>\n<p>\n<b>Spr\u00e1va \u00fa\u010dt\u016f<\/b><\/p>\n<ul>\n<li>Spr\u00e1va u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f;<\/li>\n<li>Spr\u00e1va bezpe\u010dnostn\u00edch skupin.<\/li>\n<\/ul>\n<p>\n<b>Zm\u011bna z\u00e1sad<\/b><\/p>\n<ul>\n<li>Zm\u011bna auditn\u00ed politiky;<\/li>\n<li>Zm\u011bna autentiza\u010dn\u00ed politiky;<\/li>\n<li>Zm\u011bna autoriza\u010dn\u00ed politiky.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Syst\u00e9mov\u00fd monitor (Sysmon)<\/h2>\n<p>\nSysmon \u2014 vestav\u011bn\u00fd n\u00e1stroj ve Windows, kter\u00fd um\u00ed zaznamen\u00e1vat ud\u00e1losti do syst\u00e9mov\u00e9ho protokolu. Obvykle je nutn\u00e9 jej instalovat zvl\u00e1\u0161\u0165.<\/p>\n<p><img decoding=\"async\" alt=\"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTyto ud\u00e1losti lze v z\u00e1sad\u011b nal\u00e9zt tak\u00e9 v protokolu zabezpe\u010den\u00ed (pokud zapnete po\u017eadovanou politiku auditu), ale Sysmon poskytuje v\u00edce podrobnost\u00ed. Jak\u00e9 ud\u00e1losti lze z\u00edskat ze Sysmon?<\/p>\n<p><b>Vytvo\u0159en\u00ed procesu (ID ud\u00e1losti 1).<\/b> Syst\u00e9mov\u00fd protokol ud\u00e1lost\u00ed zabezpe\u010den\u00ed m\u016f\u017ee tak\u00e9 \u0159\u00edct, kdy se spustil n\u011bjak\u00fd *.exe a dokonce uk\u00e1\u017ee jeho n\u00e1zev a cestu ke spu\u0161t\u011bn\u00ed. Ale na rozd\u00edl od Sysmonu nedok\u00e1\u017ee uk\u00e1zat hash aplikace. \u0160kodliv\u00fd software se m\u016f\u017ee jmenovat i ne\u0161kodn\u011b notepad.exe, ale pr\u00e1v\u011b hash odhal\u00ed jeho pravou povahu.<\/p>\n<p><b>S\u00ed\u0165ov\u00e1 p\u0159ipojen\u00ed (ID ud\u00e1losti 3).<\/b> Je z\u0159ejm\u00e9, \u017ee s\u00ed\u0165ov\u00fdch p\u0159ipojen\u00ed je mnoho a nen\u00ed mo\u017en\u00e9 je v\u0161echny sledovat. Ale je d\u016fle\u017eit\u00e9 m\u00edt na pam\u011bti, \u017ee Sysmon na rozd\u00edl od protokolu zabezpe\u010den\u00ed dok\u00e1\u017ee spojit s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed s poli ProcessID a ProcessGUID a ukazuje port a <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adres\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">IP adres<\/a> zdroj a p\u0159\u00edjemce.<\/p>\n<p><b>Zm\u011bny v syst\u00e9mov\u00e9m registru (ID ud\u00e1losti 12-14).<\/b> Nejjednodu\u0161\u0161\u00ed zp\u016fsob, jak se p\u0159idat do automatick\u00e9ho spou\u0161t\u011bn\u00ed, je zapisovat se do registru. Security Log to um\u00ed, ale Sysmon ukazuje, kdo provedl zm\u011bny, kdy, odkud, process ID a p\u0159edchoz\u00ed hodnotu kl\u00ed\u010de.<\/p>\n<p><b>Vytvo\u0159en\u00ed souboru (ID ud\u00e1losti 11).<\/b> Sysmon, na rozd\u00edl od Security Log, uk\u00e1\u017ee nejen um\u00edst\u011bn\u00ed souboru, ale i jeho n\u00e1zev. Je jasn\u00e9, \u017ee na v\u0161e se ned\u00e1 dohl\u00e9dnout, ale lze prov\u00e1d\u011bt audit ur\u010dit\u00fdch adres\u00e1\u0159\u016f.<\/p>\n<p>A nyn\u00ed to, co v politice Security Log nen\u00ed, ale je v Sysmon:<\/p>\n<p><b>Zm\u011bna \u010dasu vytvo\u0159en\u00ed souboru (ID ud\u00e1losti 2).<\/b> N\u011bkter\u00fd malware m\u016f\u017ee m\u011bnit datum vytvo\u0159en\u00ed souboru, aby byl skryt z report\u016f s ned\u00e1vno vytvo\u0159en\u00fdmi soubory.<\/p>\n<p><b>Na\u010d\u00edt\u00e1n\u00ed ovlada\u010d\u016f a dynamick\u00fdch knihoven (ID ud\u00e1lost\u00ed 6-7).<\/b> Sledov\u00e1n\u00ed na\u010d\u00edt\u00e1n\u00ed DLL a ovlada\u010d\u016f za\u0159\u00edzen\u00ed do pam\u011bti, kontrola digit\u00e1ln\u00edho podpisu a jeho platnosti.<\/p>\n<p><b>Vytvo\u0159en\u00ed vl\u00e1kna v b\u011b\u017e\u00edc\u00edm procesu (ID ud\u00e1losti 8).<\/b> Jeden z typ\u016f \u00fatok\u016f, na kter\u00e9 je t\u0159eba tak\u00e9 d\u00e1vat pozor.<\/p>\n<p><b>Ud\u00e1losti RawAccessRead (ID ud\u00e1losti 9).<\/b> Operace \u010dten\u00ed z disku pomoc\u00ed \u201c.\u201d. V naprost\u00e9 v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f by takov\u00e1 aktivita m\u011bla b\u00fdt pova\u017eov\u00e1na za anom\u00e1ln\u00ed.<\/p>\n<p><b>Vytvo\u0159en\u00ed pojmenovan\u00e9ho souborov\u00e9ho proudu (ID ud\u00e1losti 15).<\/b> Ud\u00e1lost se registruje, kdy\u017e se vytvo\u0159\u00ed pojmenovan\u00fd souborov\u00fd proud, kter\u00fd generuje ud\u00e1losti s hashovan\u00fdm obsahem souboru.<\/p>\n<p><b>Vytvo\u0159en\u00ed named pipe a p\u0159ipojen\u00ed (ID ud\u00e1losti 17-18).<\/b> Sledov\u00e1n\u00ed malware, kter\u00fd komunikuje s jin\u00fdmi komponentami p\u0159es named pipe.<\/p>\n<p><b>Aktivita WMI (ID ud\u00e1losti 19).<\/b> Registrace ud\u00e1lost\u00ed, kter\u00e9 jsou generov\u00e1ny p\u0159i p\u0159\u00edstupu k syst\u00e9mu prost\u0159ednictv\u00edm protokolu WMI.<\/p>\n<p>Pro ochranu samotn\u00e9ho Sysmon je t\u0159eba sledovat ud\u00e1losti s ID 4 (zastaven\u00ed a spu\u0161t\u011bn\u00ed Sysmon) a ID 16 (zm\u011bna konfigurace Sysmon).<\/p>\n<h2>Power Shell Logy<\/h2>\n<p>\nPower Shell je mocn\u00fd n\u00e1stroj pro spr\u00e1vu Windows infrastruktury, proto je velk\u00e1 \u0161ance, \u017ee \u00fato\u010dn\u00edk zvol\u00ed pr\u00e1v\u011b jeho. Pro z\u00edsk\u00e1n\u00ed \u00fadaj\u016f o ud\u00e1lostech Power Shell lze pou\u017e\u00edt dva zdroje: Windows PowerShell log a Microsoft-WindowsPowerShell \/ Operational log.<\/p>\n<h4>Windows PowerShell log<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Na\u010dten dodavatel dat (ID ud\u00e1losti 600).<\/b> Poskytovatel\u00e9 PowerShell jsou programy, kter\u00e9 slou\u017e\u00ed jako zdroje dat pro PowerShell pro jejich prohl\u00ed\u017een\u00ed a spr\u00e1vu. Nap\u0159\u00edklad mezi integrovan\u00e9 poskytovatele mohou pat\u0159it prom\u011bnn\u00e9 prost\u0159ed\u00ed Windows nebo syst\u00e9mov\u00fd registr. Je d\u016fle\u017eit\u00e9 sledovat nov\u00e9 poskytovatele, aby bylo mo\u017en\u00e9 v\u010das odhalit zlovolnou \u010dinnost. Pokud nap\u0159\u00edklad zjist\u00edte, \u017ee mezi poskytovateli se objevil WSMan, znamen\u00e1 to, \u017ee byl zah\u00e1jen vzd\u00e1len\u00fd sezen\u00ed PowerShell.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Provozn\u00ed z\u00e1znam (nebo MicrosoftWindows-PowerShellCore \/ Provozn\u00ed v PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Zalogov\u00e1n\u00ed modul\u016f (ID ud\u00e1losti 4103).<\/b> V ud\u00e1lostech jsou uchov\u00e1v\u00e1ny informace o ka\u017ed\u00e9m proveden\u00e9m p\u0159\u00edkazu a parametrech, s nimi\u017e byl vyvol\u00e1n.<\/p>\n<p><b>Zalogov\u00e1n\u00ed blokace skript\u016f (ID ud\u00e1losti 4104).<\/b> Zalogov\u00e1n\u00ed blokace skript\u016f zobrazuje ka\u017ed\u00fd proveden\u00fd blok k\u00f3du PowerShell. I kdyby se \u00fato\u010dn\u00edk pokusil skr\u00fdt p\u0159\u00edkaz, tento typ ud\u00e1losti uk\u00e1\u017ee fakticky proveden\u00fd p\u0159\u00edkaz PowerShell. D\u00e1le v tomto typu ud\u00e1losti mohou b\u00fdt zaznamen\u00e1ny n\u011bkter\u00e9 prov\u00e1d\u011bn\u00e9 n\u00edzko\u00farov\u0148ov\u00e9 vol\u00e1n\u00ed API, tyto ud\u00e1losti jsou obvykle zaznamen\u00e1ny jako Verbose, ale pokud je v bloku k\u00f3du pou\u017eit podez\u0159el\u00fd p\u0159\u00edkaz nebo skript, bude zaregistrov\u00e1n s kriti\u010dnost\u00ed Warning.<\/p>\n<p>Vezm\u011bte pros\u00edm na v\u011bdom\u00ed, \u017ee po nastaven\u00ed n\u00e1stroje pro shroma\u017e\u010fov\u00e1n\u00ed a anal\u00fdzu t\u011bchto ud\u00e1lost\u00ed bude pot\u0159eba dal\u0161\u00ed \u010das na lad\u011bn\u00ed, aby se sn\u00ed\u017eil po\u010det fale\u0161n\u00fdch pozitiv.<\/p>\n<p>Pod\u011blte se v koment\u00e1\u0159\u00edch o to, jak\u00e9 protokoly shroma\u017e\u010fujete pro audit informa\u010dn\u00ed bezpe\u010dnosti a jak\u00e9 n\u00e1stroje k tomu pou\u017e\u00edv\u00e1te. Jedno z na\u0161ich zam\u011b\u0159en\u00ed je \u0159e\u0161en\u00ed pro audit ud\u00e1lost\u00ed informa\u010dn\u00ed bezpe\u010dnosti. Pro shroma\u017e\u010fov\u00e1n\u00ed a anal\u00fdzu protokol\u016f v\u00e1m m\u016f\u017eeme doporu\u010dit pod\u00edvat se na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, kter\u00fd um\u00ed komprimovat uchov\u00e1van\u00e1 data s pom\u011brem 20:1, a jeden jeho nainstalovan\u00fd instance dok\u00e1\u017ee zpracov\u00e1vat a\u017e 60000 ud\u00e1lost\u00ed za sekundu z 10000 zdroj\u016f.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00ed stanice na b\u00e1zi OS Windows | ProHoster","description":"U\u017eivatelsk\u00e1 pracovn\u00ed stanice je nejzraniteln\u011bj\u0161\u00edm m\u00edstem infrastruktury z hlediska informa\u010dn\u00ed bezpe\u010dnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}