This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

1
vote
0answers
25 views

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
1
vote
1answer
9 views

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only ...
1
vote
1answer
23 views

Auditing Log is Full - Eventlog Archive GPO not working

I am trying to create an Archive for Eventlog but it does not seem to work. Server 2k12 R2 Environment. Following is the GPO I have enabled: I have rebooted the server and made sure it is being ...
1
vote
1answer
87 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0answers
23 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
0
votes
0answers
64 views

Windows task scheduler event viewer trigger 0x800704DD

I am creating a Windows task in Windows 2008 R2 for an Event Viewer event. I wish for it to display a dialog box. However the task will only trigger if a user is logged in. I wish for the task to ...
1
vote
1answer
83 views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
0
votes
0answers
14 views

Event Forwarding

I am taking the MCITP 70-685 Windows 7 Enterprise Desktop Support Technician and am trying to set up Event Forwarding. My setup (As I need three separate OS' which I'm running on two computers) is ...
1
vote
0answers
83 views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
0
votes
1answer
75 views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
0
votes
0answers
18 views

Windows Log size Policy

I have implement the policy for Windows log size as follows ( Please see the print-screen ) But, when i click on Event Viewer -- Application -- Properties, i see below size ( please see below print-...
1
vote
1answer
417 views

Event log subscription returns error code (0x138C)

I have been battling getting Event log subscriptions to work on my server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1answer
89 views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
0
votes
1answer
36 views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
1
vote
0answers
136 views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
1
vote
1answer
71 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
0
votes
1answer
38 views

Windows 7 Pro blue screen Event Viewer Event ID 10

I have a user who's Windows 7 Pro machine repeatedly blue screens and the Event Viewer has numerous entries like below that seem to occur about the time of the BSOD occurrences. I would appreciate any ...
0
votes
1answer
22 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
3
votes
1answer
73 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
-1
votes
1answer
16 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...
1
vote
1answer
94 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
1
vote
0answers
282 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
44 views

Event Viewer, Network Address empty

I receive empty Network Address with value - from an unknown attacker that attack my RDP. I have searched from previous questions but no correct answer. I have set the Remote Desktop Host to use RDP ...
4
votes
1answer
174 views

How Can I Consolidate all Event Viewer Logs from different Servers

Currently I use Microsoft Management Console to check Event Viewer logs on 20 servers. Every time I click on one server, my custom view it takes 2 minutes to load. I need to find a faster way to check ...
0
votes
0answers
88 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
0
votes
3answers
660 views

How to export event viewer errors to Excel in Windows Server 2012

How would I export errors of event viewer from Application and Security section to excel, it has any way to export in event viewer or I must use windows powershell?
0
votes
0answers
63 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
271 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
1
vote
0answers
106 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> <...
3
votes
1answer
262 views

Change an Applications and Services Logs log path using GPO

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL. I know you can ...
0
votes
1answer
37 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
0
votes
0answers
291 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
1
vote
0answers
162 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
1
vote
1answer
217 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
0
votes
0answers
142 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
3
votes
2answers
2k views

how to separate IIS event logs by application in event viewer

Just to start with, I would like to advise I am VERY new to IIS so apologies for any obvious questions in advance. I have done some research around this topic and my findings have been inconclusive. ...
0
votes
1answer
124 views

ASP.NET APP on IIS 7.5 on windows server 2008 r2 - does not log unhandled exceptions

we have APS.NET application running on IIS 7.5 on Server 2008r2. When developers debug the code in VS2012 web server the unhandled exceptions are logged in EventViewer but when the app is deployed on ...
0
votes
1answer
285 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
936 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
3
votes
1answer
3k views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
2answers
348 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
1
vote
3answers
2k views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
4
votes
3answers
13k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
1
vote
0answers
726 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
1answer
694 views

Win2012R2 Eventlog subscription don't display informations

I have two Win2012R2 servers. One is the Domain Controller, the other is an SQL Server. I created a subscription on the DC, gathering events 1149 (source : TerminalServices-RemoteConnectionManager) ...
1
vote
1answer
193 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
499 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
2
votes
1answer
782 views

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to ...
0
votes
2answers
245 views

Notification of low DHCP pool in split scope setup

In Windows Server 2008 R2, it is possible to read the Event Viewer for EventID 1020 which is an indication that the DHCP pool is running low on addresses. What if I have two DHCP servers in my domain ...
1
vote
1answer
102 views

I set up email alerts in event viewer for 4624. How do I turn them off now?

My inbox is now flooded with alerts as someone added a share that is causing 4624's to be fired every few seconds. I thought I set up the alert under the event viewer. but I don't see where or how to ...