This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

2
votes
1answer
958 views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
0answers
8 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
17 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
3
votes
3answers
4k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
0
votes
1answer
1k views

What is the Event id for File & folder creation in Window Server 2008

I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event ...
13
votes
1answer
4k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
3
votes
1answer
3k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
3
votes
1answer
4k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
7
votes
1answer
2k views

Application Event Log keeps getting corrupted

I recently asked about repairing a corrupt event log, because it seemed to be a one-off event. The event log has since exhibited the same behavior 3 times. We have been trying to find patterns, but ...
1
vote
0answers
41 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
18
votes
4answers
63k views

View Shutdown Event Tracker logs under Windows Server 2008 R2

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server. Where in the Event ...
4
votes
2answers
2k views

users unable to view security log in event viewer

I want to create a user account who is able to view the security log in event viewer, but not as a administrator, just as a power user. I had been getting this error when I click the security log: ...
1
vote
1answer
67 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
1
vote
1answer
888 views

What could cause local folders in a Windows 2008 DFS replication group to randomly obtain system and hidden attributes

We have a Windows 2008 server (not R2) acting as a primary file source in a DFS replication group with a single other server that happens to be Windows Storage Server 2008. All is well in terms of ...
2
votes
2answers
7k views

Remote Desktop Services login history

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server? The closest Event Viewer logs I can find are under Application and Services Logs --> ...
4
votes
3answers
6k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
3
votes
1answer
47 views

Change an Applications and Services Logs log path using GPO

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL. I know you can ...
2
votes
2answers
234 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
4
votes
1answer
25k views

Event 36888: The following fatal alert was generated: 10. The internal error state is 1203

I've searched online, but am unable to find any information; why this error is occurring? It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the ...
1
vote
1answer
5k views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
2
votes
3answers
25k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
0
votes
1answer
33 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
3
votes
4answers
5k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...
0
votes
0answers
97 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
1
vote
0answers
63 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
0
votes
0answers
58 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
3
votes
1answer
3k views

Script to export custom view Event Viewer to .evtx Powershell

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data. set-executionpolicy unrestricted [xml]$CustomView = @" <QueryList> <Query Id="0" ...
2
votes
2answers
457 views

how to separate IIS event logs by application in event viewer

Just to start with, I would like to advise I am VERY new to IIS so apologies for any obvious questions in advance. I have done some research around this topic and my findings have been inconclusive. ...
2
votes
2answers
566 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
0
votes
1answer
70 views

ASP.NET APP on IIS 7.5 on windows server 2008 r2 - does not log unhandled exceptions

we have APS.NET application running on IIS 7.5 on Server 2008r2. When developers debug the code in VS2012 web server the unhandled exceptions are logged in EventViewer but when the app is deployed on ...
0
votes
1answer
189 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
444 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
0
votes
0answers
70 views

Need set of event ids that occurs in event viewer during file creation event

I need the set of event ids that occur in the event viewer when I created a file in shared folders (auditing was enabled for the folder) in domain controllers. I know the fact that the event id 4656 ...
0
votes
2answers
115 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
0
votes
0answers
17 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
3answers
953 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
8
votes
2answers
16k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
0answers
509 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
1answer
321 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
7
votes
1answer
1k views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
0
votes
1answer
378 views

Win2012R2 Eventlog subscription don't display informations

I have two Win2012R2 servers. One is the Domain Controller, the other is an SQL Server. I created a subscription on the DC, gathering events 1149 (source : TerminalServices-RemoteConnectionManager) ...
2
votes
1answer
465 views

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to ...
1
vote
1answer
124 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
2answers
140 views

Notification of low DHCP pool in split scope setup

In Windows Server 2008 R2, it is possible to read the Event Viewer for EventID 1020 which is an indication that the DHCP pool is running low on addresses. What if I have two DHCP servers in my domain ...
1
vote
1answer
82 views

I set up email alerts in event viewer for 4624. How do I turn them off now?

My inbox is now flooded with alerts as someone added a share that is causing 4624's to be fired every few seconds. I thought I set up the alert under the event viewer. but I don't see where or how to ...
2
votes
1answer
616 views

Save Custom View from Event Viewer in .evtx

I have a Custom View in the Event Viewer with a couple of Event id's. I know you can save those event id's in an .evtx file to open it. This proces has to be executed manually. Now is my question, how ...
1
vote
1answer
555 views

Backup/export custom view automatically from Event Viewer

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically ...
2
votes
1answer
60 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
2
votes
2answers
3k views

Event 4098, 0x80070533 Logon failure: account currently disabled?

Having started to upgrade our PCs to Windows 7 we have noticed that we are getting group policy warnings in Event Viewer such as: "The user 'Word.qat' preference item in the 'a_Office2007_Users ...
4
votes
5answers
2k views

shortcut for Eventvwr > Connect to another computer

I was wondering if you can write the following action in a batch command? eventvwr (open the event viewer) Menu Action > Connect to another computer Type in the name of the computer. Connect. This ...