 In addition to the Windows Security Log, administrators can check the Internet Connection Firewall security log for clues.It is theoretically possible to write false events to the log.Microsoft notes, "To be able to write to the Security log, SeAuditPrivilege is required.