Question : Can a Windows 2003 Server Event Log File be changed

We are trying to find out what or who activated a service process on a server and a key log file entry is missing. I recreated the event on a test sever by starting the service and it generates an event log with my name on it. Can the .evt file be opened and changed then replaced.

Answer : Can a Windows 2003 Server Event Log File be changed

Yes

To do this you must disable the event log service from running at boot

reboot, then edit the file (un-attribing it, then using notepad or Word.) Then re-enable the event log service and reboot again.