This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

0
votes
0answers
8 views

How to get the domain controller time sync event? [migrated]

My computer is part of the domain. Say I manually adjust the clock to be off by 2min. Domain controller will sync this clock with its own at some point. Is it possible to track domain controller time ...
0
votes
0answers
22 views

Interent Explorer Log is empty always [migrated]

OS- Windows 7 Professional & Windows Server 2008 R2 In Event Veiwer --> Application and Serverices logs --> Internet Explorer there is no log, it is always empty. I need to check why my Internet ...
0
votes
1answer
43 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
62 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
0
votes
0answers
81 views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
2answers
35 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
0
votes
0answers
31 views

Need set of event ids that occurs in event viewer during file creation event

I need the set of event ids that occur in the event viewer when I created a file in shared folders (auditing was enabled for the folder) in domain controllers. I know the fact that the event id 4656 ...
0
votes
0answers
8 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
3answers
152 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
2
votes
2answers
1k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
1
vote
0answers
200 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
1answer
137 views

Win2012R2 Eventlog subscription don't display informations

I have two Win2012R2 servers. One is the Domain Controller, the other is an SQL Server. I created a subscription on the DC, gathering events 1149 (source : TerminalServices-RemoteConnectionManager) ...
1
vote
1answer
74 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
178 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
2
votes
1answer
201 views

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to ...
0
votes
2answers
53 views

Notification of low DHCP pool in split scope setup

In Windows Server 2008 R2, it is possible to read the Event Viewer for EventID 1020 which is an indication that the DHCP pool is running low on addresses. What if I have two DHCP servers in my domain ...
1
vote
1answer
50 views

I set up email alerts in event viewer for 4624. How do I turn them off now?

My inbox is now flooded with alerts as someone added a share that is causing 4624's to be fired every few seconds. I thought I set up the alert under the event viewer. but I don't see where or how to ...
1
vote
1answer
291 views

Save Custom View from Event Viewer in .evtx

I have a Custom View in the Event Viewer with a couple of Event id's. I know you can save those event id's in an .evtx file to open it. This proces has to be executed manually. Now is my question, how ...
3
votes
1answer
2k views

Script to export custom view Event Viewer to .evtx Powershell

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data. set-executionpolicy unrestricted [xml]$CustomView = @" <QueryList> <Query Id="0" ...
1
vote
1answer
220 views

Backup/export custom view automatically from Event Viewer

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically ...
2
votes
1answer
51 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
9
votes
1answer
953 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
0
votes
0answers
282 views

Event log with thousands of Audit Success events regarding cryptography

I have a Windows Server 2008 R2 Standard running IIS web apps, today the websites were operating fine however when I tried to use Teamviewer on it, it was extremely slow and was losing connection all ...
5
votes
2answers
5k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
2
votes
1answer
249 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
1
vote
2answers
134 views

Suspicious Login Success in Event Viewer

Hope you can help. We have been noticing another user's local machine creating logon entries in the event viewer of our machine. The message received is "An account was successfully logged on". The ...
2
votes
2answers
274 views

GPO set to trigger in response to an event?

I want to trigger an action/task when an event is raised in any computer of the domain. It this possible via GPO, do or I need to deploy script to all machines on the domain?
5
votes
0answers
2k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
-1
votes
2answers
286 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
2
votes
1answer
448 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
0
votes
0answers
83 views

Windows Server Audit Failure from Client

Every several minutes I get an audit failure from one of my clients running Windows 8 on ports 56280 to 56294 in the event log of my server which provides DHCP/DNS/DC for that client. Do you have any ...
0
votes
3answers
529 views

Windows Server 2003: start program on event in event viewer

With windows server 2008 you can start a program using scheduled task triggered by event on event viewer. Is there a way to emulate this with Windows Server 2003? Thank you in advance
1
vote
1answer
2k views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
7
votes
1answer
826 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
0
votes
1answer
222 views

Windows event viewer application logs lost after reboot

I need to check event viewer's application logs for uninstall events. So, I filtered them on MSIInstaller. Turns out I can see logs only upto last reboot which was just a few hours ago from writting ...
-1
votes
2answers
312 views

Event Viewer Task for a specific task

I can create Event Viewer Tasks to react to Event IDs, but I'm having a tough time getting the XML working to react to an event ID to a specific task. I've been testing using the filter. The task ...
0
votes
1answer
50 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
4
votes
2answers
237 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
2
votes
0answers
458 views

Powershell 3.0 Enter-PSSession fails randomly, reboot solves it. DCOM error in Event Viewer on target machine

Using PowerShell's Enter-PSSession (even locally, against the local computer) fails randomly with the following message. Running Windows 2012 Standard with all updates. The error message takes a while ...
0
votes
1answer
341 views

7024 event on Windows service shutdown

I am seeing the following event in event viewer: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" ...
0
votes
1answer
100 views

Event Viewer Custom View Different Paths

I'm having trouble with a custom Event Viewer filter to show events that match both selects. Here is what I have so far: <QueryList> <Query Id="0" Path="System"> <Select ...
0
votes
1answer
122 views

Can eventvwr.msc's log files be exported to text or sql server in Windows?

Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files? Every search I do on Google for this returns how to export ...
1
vote
1answer
5k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
1
vote
1answer
200 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
1
vote
1answer
3k views

Remote Desktop Services login history

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server? The closest Event Viewer logs I can find are under Application and Services Logs --> ...
-4
votes
1answer
104 views

Inject events in the event viewer in an old date [closed]

I need to inject some event in my event viewer in an old date, how event viewer data are stored, and can I change it? ** EDIT ** I need it to know that if any one, In any way can fool me and do ...
1
vote
1answer
816 views

Send mail on event log error trigger safe check frequency

I want to use powershell to alert me when an error occurs in the event viewer on my new Win2k12 Standard Server, I was thinking I could have the script execute every 10mins but don't want to put any ...
2
votes
1answer
322 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
4
votes
1answer
1k views

Can I disable Windows Event Logging for a certain service?

We have a legacy application running on a Windows Server 2008 VM from Azure that is spamming our windows event log every minute or so. I do not have access to the source for the bit of code that is ...
0
votes
2answers
738 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...