How to monitor Microsoft CA logs on Server 2008 R2?

[jodros]

Has anyone been successful in monitoring Microsoft CA logs on Server 2008 R2? It looks as if they are being written to C:\Windows\System32\CertLog in EDB log format, which is not human readable. I want to say the EDB log format might also be used by Microsoft Exchange, so I don't know if any TA or SA for exchange could be leveraged.

Any assistance with this issue would be appreciated.

Thanks

[jodros · Accepted solution]

Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.

[thambisetty]

would be helpful, if you could provide how did you fix this.

[nabeel652]

Do you remember what change did you make in GPO in order to collect CerLog like EventCode=64 etc?

[jlemoine]

What was the solution?

[jodros]

early morning bump. No one is monitoring any Microsoft CA servers running on 2008 R2 with Splunk?