This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

1
vote
1answer
5 views

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only ...
0
votes
1answer
2k views

What is the Event id for File & folder creation in Window Server 2008

I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event ...
0
votes
0answers
11 views

Event log viewer returns “ Failed to open event query. Access is denied” from java programme [on hold]

When I run the command above in CMD from remote server wevtutil qe application /r:server name /u:user /p:password /rd:true /f:text /q:"*[System[(EventID=17972) and TimeCreated[timediff(@SystemTime) &...
1
vote
1answer
14 views

Auditing Log is Full - Eventlog Archive GPO not working

I am trying to create an Archive for Eventlog but it does not seem to work. Server 2k12 R2 Environment. Following is the GPO I have enabled: I have rebooted the server and made sure it is being ...
3
votes
1answer
4k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
8
votes
2answers
3k views

Application Event Log keeps getting corrupted

I recently asked about repairing a corrupt event log, because it seemed to be a one-off event. The event log has since exhibited the same behavior 3 times. We have been trying to find patterns, but ...
0
votes
3answers
555 views

How to export event viewer errors to Excel in Windows Server 2012

How would I export errors of event viewer from Application and Security section to excel, it has any way to export in event viewer or I must use windows powershell?
1
vote
1answer
81 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
4
votes
6answers
38k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
0
votes
0answers
22 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
0
votes
0answers
48 views

Windows task scheduler event viewer trigger 0x800704DD

I am creating a Windows task in Windows 2008 R2 for an Event Viewer event. I wish for it to display a dialog box. However the task will only trigger if a user is logged in. I wish for the task to ...
1
vote
1answer
51 views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
1
vote
0answers
78 views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
0
votes
0answers
12 views

Event Forwarding

I am taking the MCITP 70-685 Windows 7 Enterprise Desktop Support Technician and am trying to set up Event Forwarding. My setup (As I need three separate OS' which I'm running on two computers) is ...
0
votes
1answer
47 views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
1
vote
1answer
65 views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
0
votes
0answers
18 views

Windows Log size Policy

I have implement the policy for Windows log size as follows ( Please see the print-screen ) But, when i click on Event Viewer -- Application -- Properties, i see below size ( please see below print-...
1
vote
0answers
317 views

Event log subscription returns error code (0x138C)

I have been battling getting Event log subscriptions to work on my server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
0
votes
1answer
32 views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
1
vote
0answers
125 views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
8
votes
1answer
4k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
1
vote
1answer
60 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
0
votes
1answer
33 views

Windows 7 Pro blue screen Event Viewer Event ID 10

I have a user who's Windows 7 Pro machine repeatedly blue screens and the Event Viewer has numerous entries like below that seem to occur about the time of the BSOD occurrences. I would appreciate any ...
3
votes
1answer
3k views

Windows 2012 R2 Server Manager Fails to Load

I am unable to open Server Manager on our Windows 2012-R2 system. The error states: Server Manager cannot run because of an error in a user settings file. Click OK to restore default settings....... ...
0
votes
1answer
22 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
16
votes
2answers
6k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance object....
3
votes
3answers
11k views

Remote Desktop Services login history

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server? The closest Event Viewer logs I can find are under Application and Services Logs --> ...
3
votes
1answer
65 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
-1
votes
1answer
16 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...
1
vote
1answer
87 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
1
vote
0answers
253 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
43 views

Event Viewer, Network Address empty

I receive empty Network Address with value - from an unknown attacker that attack my RDP. I have searched from previous questions but no correct answer. I have set the Remote Desktop Host to use RDP ...
4
votes
1answer
168 views

How Can I Consolidate all Event Viewer Logs from different Servers

Currently I use Microsoft Management Console to check Event Viewer logs on 20 servers. Every time I click on one server, my custom view it takes 2 minutes to load. I need to find a faster way to check ...
1
vote
2answers
13k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
3
votes
2answers
10k views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
0
votes
0answers
80 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
0
votes
0answers
62 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
249 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
3
votes
3answers
6k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
1
vote
0answers
98 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> <...
24
votes
4answers
94k views

View Shutdown Event Tracker logs under Windows Server 2008 R2

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server. Where in the Event ...
4
votes
2answers
3k views

users unable to view security log in event viewer

I want to create a user account who is able to view the security log in event viewer, but not as a administrator, just as a power user. I had been getting this error when I click the security log: ...
1
vote
1answer
205 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
1
vote
1answer
964 views

What could cause local folders in a Windows 2008 DFS replication group to randomly obtain system and hidden attributes

We have a Windows 2008 server (not R2) acting as a primary file source in a DFS replication group with a single other server that happens to be Windows Storage Server 2008. All is well in terms of 2-...
4
votes
3answers
12k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
3
votes
1answer
258 views

Change an Applications and Services Logs log path using GPO

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL. I know you can ...
2
votes
2answers
238 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error (...
6
votes
1answer
39k views

Event 36888: The following fatal alert was generated: 10. The internal error state is 1203

I've searched online, but am unable to find any information; why this error is occurring? It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the ...
0
votes
1answer
37 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
3
votes
4answers
6k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...