This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

0
votes
0answers
5 views

PHP reporting to Event Viewer

I've succeeded in reporting all errors to the windows event log. Now I am trying to create a custom view to see only PHP errors from the Application log, but PHP does not show up in the "By source" ...
1
vote
0answers
35 views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
1
vote
1answer
21 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
0
votes
1answer
21 views

Windows 7 Pro blue screen Event Viewer Event ID 10

I have a user who's Windows 7 Pro machine repeatedly blue screens and the Event Viewer has numerous entries like below that seem to occur about the time of the BSOD occurrences. I would appreciate any ...
0
votes
1answer
22 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
3
votes
1answer
35 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
-1
votes
1answer
11 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...
1
vote
1answer
20 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
1
vote
0answers
72 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
26 views

Event Viewer, Network Address empty

I receive empty Network Address with value - from an unknown attacker that attack my RDP. I have searched from previous questions but no correct answer. I have set the Remote Desktop Host to use RDP ...
4
votes
1answer
141 views

How Can I Consolidate all Event Viewer Logs from different Servers

Currently I use Microsoft Management Console to check Event Viewer logs on 20 servers. Every time I click on one server, my custom view it takes 2 minutes to load. I need to find a faster way to check ...
0
votes
0answers
49 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
1
vote
2answers
184 views

How to export event viewer errors to Excel in Windows Server 2012

How would I export errors of event viewer from Application and Security section to excel, it has any way to export in event viewer or I must use windows powershell?
0
votes
0answers
37 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
151 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
1
vote
0answers
76 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
3
votes
1answer
189 views

Change an Applications and Services Logs log path using GPO

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL. I know you can ...
0
votes
1answer
35 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
0
votes
0answers
198 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
1
vote
0answers
119 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
1
vote
1answer
148 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
0
votes
0answers
94 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
3
votes
2answers
1k views

how to separate IIS event logs by application in event viewer

Just to start with, I would like to advise I am VERY new to IIS so apologies for any obvious questions in advance. I have done some research around this topic and my findings have been inconclusive. ...
0
votes
1answer
87 views

ASP.NET APP on IIS 7.5 on windows server 2008 r2 - does not log unhandled exceptions

we have APS.NET application running on IIS 7.5 on Server 2008r2. When developers debug the code in VS2012 web server the unhandled exceptions are logged in EventViewer but when the app is deployed on ...
0
votes
1answer
238 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
667 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
3
votes
1answer
2k views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
2answers
192 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
1
vote
3answers
1k views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
4
votes
3answers
10k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
1
vote
0answers
625 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
1answer
519 views

Win2012R2 Eventlog subscription don't display informations

I have two Win2012R2 servers. One is the Domain Controller, the other is an SQL Server. I created a subscription on the DC, gathering events 1149 (source : TerminalServices-RemoteConnectionManager) ...
1
vote
1answer
166 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
412 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
2
votes
1answer
619 views

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to ...
0
votes
2answers
193 views

Notification of low DHCP pool in split scope setup

In Windows Server 2008 R2, it is possible to read the Event Viewer for EventID 1020 which is an indication that the DHCP pool is running low on addresses. What if I have two DHCP servers in my domain ...
1
vote
1answer
95 views

I set up email alerts in event viewer for 4624. How do I turn them off now?

My inbox is now flooded with alerts as someone added a share that is causing 4624's to be fired every few seconds. I thought I set up the alert under the event viewer. but I don't see where or how to ...
2
votes
1answer
746 views

Save Custom View from Event Viewer in .evtx

I have a Custom View in the Event Viewer with a couple of Event id's. I know you can save those event id's in an .evtx file to open it. This proces has to be executed manually. Now is my question, how ...
3
votes
1answer
4k views

Script to export custom view Event Viewer to .evtx Powershell

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data. set-executionpolicy unrestricted [xml]$CustomView = @" <QueryList> <Query Id="0" ...
1
vote
1answer
735 views

Backup/export custom view automatically from Event Viewer

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically ...
2
votes
1answer
65 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
9
votes
1answer
4k views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
8
votes
2answers
24k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
2
votes
2answers
894 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
1
vote
2answers
307 views

Suspicious Login Success in Event Viewer

Hope you can help. We have been noticing another user's local machine creating logon entries in the event viewer of our machine. The message received is "An account was successfully logged on". The ...
2
votes
2answers
967 views

GPO set to trigger in response to an event?

I want to trigger an action/task when an event is raised in any computer of the domain. It this possible via GPO, do or I need to deploy script to all machines on the domain?
14
votes
2answers
5k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
-1
votes
2answers
814 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
2
votes
1answer
944 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
0
votes
0answers
174 views

Windows Server Audit Failure from Client

Every several minutes I get an audit failure from one of my clients running Windows 8 on ports 56280 to 56294 in the event log of my server which provides DHCP/DNS/DC for that client. Do you have any ...