Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the middle of troubleshooting an error with one of my Windows Server 2008 R2 instances, but I'm pretty new to windows server management. As part of troubleshooting this problem, I'm trying to gather as much information as I can about what might have changed to help me figure out root cause. I know with many tools and systems there are logs that record changes. Is there anything similar to that for Windows Server 2008 R2? If so, where is it/are they?

share|improve this question
up vote 3 down vote accepted

Not by default, not globally.

You're basically left with sifting through the Event Logs, and hunting down any application or role-specific logs that don't go to the event log. All while hoping that whatever it is actually possesses the capability to log whatever configuration change happened, and is set to do so. It's plenty unfun, and frequently futile. Which brings us to..

What you're looking for, which would help you next time, would be a configuration management suite, and probably some form or log redirection/collection. Rather than beating your head against the wall looking for something that may or may not be there, I'd recommend spending your efforts on configuration management/monitoring and/or log redirection/collection, as well as ensuring that you have the appropriate logging levels set on all your servers.

The Microsoft configuration management suite is SCCM, and there's also a new feature in PowerShell 4 called Desired State Configuration, or DSC. There are plenty of competing products and services in the configuration management and monitoring arena, some of which are even free, but we don't do product recommendations here, so you'll have to hunt those down on your own, or with help from elsewhere.

There is a built-in capability in Windows for Event Log forwarding, which can be useful in creating a central location for your various servers' Event Logs, but of course, this only applies to Event Logs. If you want to collect, redirect or forward other logs, you need to do that manually, for each service/application/role that doesn't logs to the Event Log. And of course, There are plenty of products and services out there for log management, but again, since we don't do product recommendations, we can't help you there either.

share|improve this answer
Another free option from MS now that I'm liking is which will track changes to some extent. – TheCleaner Feb 13 '14 at 18:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.