Turning off logging from the command line
Before or after an attack, an intruder weakens the machine's own record. In the recordings they clear and disable the audit policy with auditpol.exe, point the Security log at a throwaway file with wevtutil, and create the MiniNt registry key, which makes Windows treat the machine as a preinstallation environment and stop writing the Security log. Ten such commands run across several machines. The recordings also contain a SAM hive copy and a registry read for a version number; those are not what this challenge asks for. Find the ten commands that turn off or weaken logging.
Hint 1
Three tools do the work here: auditpol.exe, wevtutil.exe and reg.exe. For reg.exe, the target is the EventLog service key or the MiniNt key, not an ordinary read.
Hint 2
auditpol with /clear, /remove or :disable weakens auditing; wevtutil with set-log changes a log; reg add on ...\Control\MiniNt creates the key.
How to defend against logging turned off from the command line
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,311 events. Search filters the table; it does not affect the result.