Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Domain Controller OS - Window Server 2008 R2

Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note the Red Rectangle Colour Box. Failure Reason: %%2313 "

enter image description here

But the same log if i check from Event Viewer ( Second Print-Screen Attached - EventViewer.png ) the same Event ID, here it Clearly shows the "Failure Reason: Unknown user name or bad Password"

enter image description here

Why with Powershell the same event id shows Failure reason with some syntax and in Event Viewer log of windows, it display correct?

share|improve this question
We typically call events like these "bugs". – Michael Hampton Feb 16 '13 at 8:18
Thanks Micheal Hampton for your comment.So,how should i correct this problem? Because with the help of Powershell i get mail for the event id and in mail we are unable to know the real reason. – Param Feb 16 '13 at 8:56 – Michael Hampton Feb 16 '13 at 9:20
up vote 2 down vote accepted

On Windows Vista and later you should use Get-WinEvent as it can read the extended event data more of the time

For more detail about this command you can use -? symbol. or Refer to this article

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.