2
votes
1answer
113 views

Windows Forward Events Missing User Data and Description

I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section. The Subscription Event ...
0
votes
0answers
45 views

Backup program completely disappeared over the weekend

Good morning everyone, I got an email on Friday from my backup software telling me I had some minor errors. I got in today and went to fix the errors but couldn't find ANY trance what so ever of the ...
0
votes
1answer
38 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
2
votes
1answer
91 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
0
votes
1answer
38 views

Can you view an individual events size in the Windows Event Log?

I'm currently using Windows 2008, and would like to view an individual event's size in the Windows Event Log (Application, Security, System logs). I have tried right clicking and selecting ...
3
votes
2answers
2k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
1
vote
1answer
62 views

How can I list the Source Network Address for failed FTP attempts in the Security Windows Log on Windows Server 2008 R2?

I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as ...
2
votes
1answer
21 views

How to make advanced audit changes in 2008 (non-R2)?

I am trying to configure auditing settings across my domain. My domain controllers are Windows Server 2008 and the rest of my environment is either 2008 or 2008 R2. Some of the audit policies I need ...
1
vote
1answer
67 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
2
votes
1answer
343 views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
0
votes
1answer
427 views

Security has requested to process its policy settings again. Error

I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO. Security has requested to process its policy settings ...
1
vote
1answer
149 views

Automatic Saving of Windows Event Logs [closed]

I'm looking for a way to automatically save off Windows security event logs from several servers to one central location (connected on the network and domain). I want to be able to do this on a ...
2
votes
0answers
305 views

What is a valid destination log for Windows event forwarding

I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid ...
0
votes
1answer
45 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
0
votes
2answers
231 views

Determine windows server attack? Should I monitor the server and block IPs all the day?

While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows: **An account failed to log on.** Subject: Security ID: SYSTEM Account Name: ...
0
votes
2answers
78 views

Windows service restart source

I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
0
votes
1answer
2k views

What would cause so many EventID 4656 PlugPlayManager Security Audit Failures at one time?

I found 141 PlugPlayManager Security Audit Failures logged within the same minute on one of our Server 2008 R2 servers (running only SQL 2008 R2). While Googling all I could find was other people, ...
2
votes
1answer
5k views

System Account Logon Failures every 30 seconds

We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
5
votes
2answers
3k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
1
vote
0answers
93 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
0
votes
1answer
188 views

auditpol starting infinite loop in command prompt

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors. I did some troubleshooting around the internet and found out that I should stop auditing a ...
2
votes
1answer
754 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
2
votes
1answer
992 views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
4
votes
1answer
14k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
1
vote
0answers
186 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
2
votes
2answers
871 views

Event viewer email alerts

Windows Server 2008 Event viewer there is an option to Attach task to this event. Is there a Microsoft solution, to send an email alert for any Error messages that flag up in the event viewer?
0
votes
1answer
970 views

Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this ...
3
votes
3answers
2k views

How to export all System event logs of a definite time period

I am working on a Windows Server 2003 SP2 with Powershell v2, and I am looking for a way to export all System event logs of a definite time period, (say, from Saturday 2000 hours to Sunday 1100 ...
0
votes
1answer
161 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
1
vote
1answer
114 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
4
votes
2answers
168 views

Forwarded Event Logs

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only ...
6
votes
6answers
2k views

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
1
vote
1answer
1k views

Windows 2008 Eventlogs best practice and server\Users permission

I have a couple questions about Windows Event Logs and permissions for server 2008 best practice and what Users is in 2008. I am trying to write EVTLogs off to another drive instead of the default ...
3
votes
2answers
1k views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
1
vote
2answers
8k views

Schannell: Certificate received from the remote server was issued by an untrusted certificate authoritythe

i'm not sure whether to ask this on dba.stackexchange.com or here. Periodically following error is logged in Windows Server 2008 Administrative events: The certificate received from the remote ...
1
vote
1answer
677 views

using New-EventLog to create logs under Applications and Services Logs

I am trying to get the new log to appear as a node under the Applications and Services Logs node in the event viewer, and I just learned here that the Powershell cmdlet New-EventLog will create a new ...
0
votes
2answers
307 views

creating Event Viewer Applications and Services Logs

On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
2
votes
2answers
2k views

New set up DHCP Server on Server 2008 R2 won't work, Event-ID 1046

I just set up a 2008 R2 as DC, and DNS. Both worked fine, DNS works fine forward and reverse lookup. Now I wanted to install DHCP. As soon as the installation of the role is finished, I get this ...
0
votes
1answer
296 views

Track changes to Windows Update settings in registry

Is it possible to track down changes to the Windows Update settings in the event logs (Win2008 R2 Std)? I tried filtering the System event log by Source = WindowsUpdateClient but this seems to list ...
3
votes
0answers
768 views

What is the Task Scheduler syntax for returning the “ComponentStatus” contents in a Windows Server Backup Event

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
0
votes
0answers
307 views

Windows 2008R2 Event Log not starting Error

I receive an error: Windows could not start the Windows Event Log service. Error 1747: The authentication service is unkown. Any idea what can cause this? 64bit W2008Web the service is indeed not ...
0
votes
1answer
535 views

Exporting logon/logoff events from Windows event log

Environment: Windows Server 2008 R2 with Samba 3.5 domain & OpenLDAP backend. Background: on our previous Terminal Server (Windows Server 2003) we used logon/logoff scripts to log user logins and ...
3
votes
1answer
4k views

Relocating event logs in Windows Server 2008 R2

How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. ...
0
votes
3answers
3k views

Server 2008 R2, Exchange 2010, WMI error event 10

The system is windows 2008 R2, with Exchange 2010 SP1 installed. I am receiving the following event log application error: event 10, WMI Event filter with query "SELECT * FROM ...
1
vote
1answer
2k views

How to filter Remote Desktop connection in Event Log filter

I need to see only success/fail logs for Remote Desktop connection. I want to monitor who (what username), when (datetime) and where (ip address) tried to connect to my remote server. How do I filter ...
0
votes
1answer
289 views

Generate Custom View logs for email to admins

I want to create a scheduled task that will take a custom view I have created in Server 2008 Event Viewer and email all the events in a .xml format once a week (Monday morning). Bonus points if you ...
1
vote
1answer
798 views

Event Id:8003 The Master Browser Error

I receive the following error on Windows Server 2008 the last a few days. event id 8003 The master browser has received a server announcement from the computer computername that believes that ...
2
votes
4answers
21k views

How can I view login/logoff times for Windows Server 2008?

I use Windows Server 2008 at my workstation and sometimes work from home. Is there an easy way of viewing the login and logoff times from the event viewer so I can see how many hours I was logged in ...
0
votes
2answers
81 views

Windows 2008 server unaccessible without traces in the event log

I am trying to figure out why a Windows 2008 server became inaccessible in terms of RDP and access to a web application. The server was turned off and then on. Look at the event log at the time it ...