This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

8
votes
1answer
2k views

Application Event Log keeps getting corrupted

I recently asked about repairing a corrupt event log, because it seemed to be a one-off event. The event log has since exhibited the same behavior 3 times. We have been trying to find patterns, but ...
1
vote
0answers
34 views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
7
votes
1answer
4k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
4
votes
5answers
32k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
-2
votes
0answers
7 views

event id:4625 with source ip [closed]

I found a lot of audit failure in event viewer for event id : 4625 from different source out of my network . do any one faced like this event? example: "An account failed to log on. Subject: ...
0
votes
1answer
2k views

What is the Event id for File & folder creation in Window Server 2008

I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event ...
3
votes
1answer
4k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
1
vote
1answer
21 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
0
votes
1answer
21 views

Windows 7 Pro blue screen Event Viewer Event ID 10

I have a user who's Windows 7 Pro machine repeatedly blue screens and the Event Viewer has numerous entries like below that seem to occur about the time of the BSOD occurrences. I would appreciate any ...
3
votes
1answer
2k views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
1answer
22 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
14
votes
2answers
5k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
3
votes
3answers
9k views

Remote Desktop Services login history

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server? The closest Event Viewer logs I can find are under Application and Services Logs --> ...
3
votes
1answer
35 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
-1
votes
1answer
11 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...
1
vote
1answer
20 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
1
vote
0answers
72 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
25 views

Event Viewer, Network Address empty

I receive empty Network Address with value - from an unknown attacker that attack my RDP. I have searched from previous questions but no correct answer. I have set the Remote Desktop Host to use RDP ...
4
votes
1answer
141 views

How Can I Consolidate all Event Viewer Logs from different Servers

Currently I use Microsoft Management Console to check Event Viewer logs on 20 servers. Every time I click on one server, my custom view it takes 2 minutes to load. I need to find a faster way to check ...
1
vote
2answers
11k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
3
votes
2answers
8k views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
0
votes
0answers
47 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
1
vote
2answers
181 views

How to export event viewer errors to Excel in Windows Server 2012

How would I export errors of event viewer from Application and Security section to excel, it has any way to export in event viewer or I must use windows powershell?
0
votes
0answers
37 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
151 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
3
votes
3answers
5k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
1
vote
0answers
76 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
22
votes
4answers
79k views

View Shutdown Event Tracker logs under Windows Server 2008 R2

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server. Where in the Event ...
4
votes
2answers
2k views

users unable to view security log in event viewer

I want to create a user account who is able to view the security log in event viewer, but not as a administrator, just as a power user. I had been getting this error when I click the security log: ...
1
vote
1answer
142 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
1
vote
1answer
913 views

What could cause local folders in a Windows 2008 DFS replication group to randomly obtain system and hidden attributes

We have a Windows 2008 server (not R2) acting as a primary file source in a DFS replication group with a single other server that happens to be Windows Storage Server 2008. All is well in terms of ...
4
votes
3answers
10k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
3
votes
1answer
189 views

Change an Applications and Services Logs log path using GPO

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL. I know you can ...
2
votes
2answers
236 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
5
votes
1answer
32k views

Event 36888: The following fatal alert was generated: 10. The internal error state is 1203

I've searched online, but am unable to find any information; why this error is occurring? It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the ...
0
votes
1answer
35 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
3
votes
4answers
5k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...
0
votes
0answers
197 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
1
vote
0answers
117 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
0
votes
0answers
94 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
3
votes
1answer
4k views

Script to export custom view Event Viewer to .evtx Powershell

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data. set-executionpolicy unrestricted [xml]$CustomView = @" <QueryList> <Query Id="0" ...
3
votes
2answers
1k views

how to separate IIS event logs by application in event viewer

Just to start with, I would like to advise I am VERY new to IIS so apologies for any obvious questions in advance. I have done some research around this topic and my findings have been inconclusive. ...
2
votes
2answers
893 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
0
votes
1answer
87 views

ASP.NET APP on IIS 7.5 on windows server 2008 r2 - does not log unhandled exceptions

we have APS.NET application running on IIS 7.5 on Server 2008r2. When developers debug the code in VS2012 web server the unhandled exceptions are logged in EventViewer but when the app is deployed on ...
0
votes
1answer
237 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
665 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
0
votes
2answers
191 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
1
vote
3answers
1k views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
8
votes
2answers
24k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
0answers
625 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...