2
votes
1answer
89 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
0
votes
2answers
231 views

Determine windows server attack? Should I monitor the server and block IPs all the day?

While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows: **An account failed to log on.** Subject: Security ID: SYSTEM Account Name: ...
1
vote
1answer
868 views

security_error_ring_buffer_recorded in system health log - what does it mean?

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012. Today I was checking the log files located in: ...
2
votes
1answer
5k views

System Account Logon Failures every 30 seconds

We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
2
votes
1answer
991 views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
1
vote
3answers
1k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
173 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
0
votes
1answer
117 views

Event Logs for Remote Share BruteForce

This command is used to access remote shares. net use \10.31.247.2\share /user:admin password Is there any way to detect(EventLogs/other tools) if someone is trying to BruteForce into a remote ...
2
votes
2answers
2k views

Listing Users using RDP

Windows Server 2008 R2 I'm trying to use PowerShell to get me a list of users who have logged into Remote Desktop Services (formerly known as Terminal Services) during the past day. With little ...
0
votes
3answers
92 views

Getting Some Specific Types of Log [closed]

I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), ...
0
votes
1answer
293 views

Strange logon activity for Administrator in Event Logs

On one of our public facing servers the Administrator account logged in at 6:45am GMT. It wasn't a member of staff. Details from the event logs 1st event Logon attempt by: ...
3
votes
2answers
2k views

Access denied error 3221225578 with file sharing to Windows server

i'm trying to access the shares on a server. The credential box appears, and i enter in a correct username and password, and i get access denied. The silly thing is that i can Remote Desktop to the ...
0
votes
1answer
433 views

Windows: Audit/View logins from remote networks?

i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures: >gpedit.msc Local Computer Policy Computer ...
4
votes
4answers
4k views

“Account locked out” security event at midnight

The last three midnights I've gotten an Event ID 539 in the log...about my own account: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 539 Date: ...
1
vote
2answers
421 views

A lot of logon/logoffs events in Windows event log

I have a server that contains Team Foundation Server which we use for source control. This server is windows server 2003, however it is not our domain server. When we do a large 'get latest version' ...
1
vote
2answers
58 views

Where can I find a list of the Windows EventCodes and their definitions?

It's fallen to me recently to sift through Windows logs and do some analysis on them. To start, I'm trying to get familiar with the EventCodes, but I've not had much success finding any comprehensive ...
0
votes
3answers
4k views

Windows Server 2003 - “The security log on this system is full.” message when logging in

When I remote desktop into one Windows Server 2003 machine, I get a popup message saying "The security log on this system is full." When I open the Event Viewer, the security log size is 512.0 KB, ...
0
votes
2answers
310 views

Stumped: Accessing Win2008 from Win2003 — domain or not

Sorry about the odd title, can't think of a good way to paraphrase this one. I have a Win2008 server that is not in a domain. I have two Win2003 machines, one in the domain, one not. All of them ...
4
votes
5answers
492 views

Logs worth to keep and analyze in a central repository

In the need to centralize logs we have selected syslog as the collector and Splunk (free for now) as the analysis tool, but there's always the question about which events should get to the central ...