This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

14
votes
3answers
44k views

View Shutdown Event Tracker logs under Windows Server 2008 R2

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server. Where in the Event ...
9
votes
1answer
1k views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
7
votes
1answer
942 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
7
votes
0answers
3k views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
7
votes
1answer
2k views

Application Event Log keeps getting corrupted

I recently asked about repairing a corrupt event log, because it seemed to be a one-off event. The event log has since exhibited the same behavior 3 times. We have been trying to find patterns, but ...
5
votes
2answers
5k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
5
votes
2answers
7k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
4
votes
2answers
281 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
4
votes
5answers
2k views

shortcut for Eventvwr > Connect to another computer

I was wondering if you can write the following action in a batch command? eventvwr (open the event viewer) Menu Action > Connect to another computer Type in the name of the computer. Connect. This ...
4
votes
1answer
1k views

Can I disable Windows Event Logging for a certain service?

We have a legacy application running on a Windows Server 2008 VM from Azure that is spamming our windows event log every minute or so. I do not have access to the source for the bit of code that is ...
4
votes
2answers
2k views

users unable to view security log in event viewer

I want to create a user account who are able to view security log in event viewer but not as a administrator but just as a power user. I had been getting this error when I click the security ...
4
votes
2answers
6k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
4
votes
1answer
20k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
3
votes
2answers
99 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
3
votes
2answers
787 views

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins ...
3
votes
3answers
8k views

Is there something like windows event viewer in linux platform?

I can check all kinds of error info with event viewer, but I'm not yet aware of there is such utility in linux, I can only check error logs of a specific application, or is there such a tool in ...
3
votes
1answer
389 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
3
votes
1answer
941 views

how do i find application name using GUID from error in event viewer on Windows Server 2003?

A Windows Serve 2003 machine logged an error in Event Viewer with the COM+ Event System, saying it could not marshal the subscriber for a particular subscription and then gave the SID/GUID, which is: ...
3
votes
1answer
2k views

Script to export custom view Event Viewer to .evtx Powershell

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data. set-executionpolicy unrestricted [xml]$CustomView = @" <QueryList> <Query Id="0" ...
3
votes
0answers
100 views

Corrupt General Tab in Event Viewer

Whenever ASP.NET reports a dangerous query string value to the Application log and the request contains a certain combination of characters; the event viewer will not show the error information and ...
3
votes
1answer
4k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
2
votes
2answers
2k views

Can not see entries in Application Log in Event Viewer

Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and ...
2
votes
3answers
4k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...
2
votes
2answers
6k views

Event Log time when Computer Start up / boot up

Client OS - Window XP Domain Controller:- Window server 2008 Standard R2 I had one Window XP system, i want to find out when the system has started or boot ( at what time and at which date ). I ...
2
votes
3answers
18k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
2
votes
2answers
3k views

Event 4098, 0x80070533 Logon failure: account currently disabled?

Having started to upgrade our PCs to Windows 7 we have noticed that we are getting group policy warnings in Event Viewer such as: "The user 'Word.qat' preference item in the 'a_Office2007_Users ...
2
votes
2answers
321 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
2
votes
2answers
364 views

GPO set to trigger in response to an event?

I want to trigger an action/task when an event is raised in any computer of the domain. It this possible via GPO, do or I need to deploy script to all machines on the domain?
2
votes
1answer
132 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
2
votes
2answers
3k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
2
votes
1answer
259 views

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to ...
2
votes
1answer
3k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
2
votes
1answer
551 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
2
votes
1answer
652 views

Mrxsmb (Event 8003) brings down the Network

There a domain with Windows SBS 2003 as the DC. At regular intervals, I am faced with the Mrxsmb (Event 8003) error which brings down the network. We have to other Windows SBS 2003 servers on the ...
2
votes
1answer
178 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
2
votes
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
2
votes
1answer
55 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
2
votes
1answer
526 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
2
votes
0answers
529 views

Powershell 3.0 Enter-PSSession fails randomly, reboot solves it. DCOM error in Event Viewer on target machine

Using PowerShell's Enter-PSSession (even locally, against the local computer) fails randomly with the following message. Running Windows 2012 Standard with all updates. The error message takes a while ...
2
votes
1answer
2k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
2
votes
0answers
611 views

Why are the results of a chkdsk scan on drive C: not showing in the event viewer, but chkdsk results for N: are?

On a Server 2008 R2 member server I schedule chkdsk to check drives C: and N:. Only the results for the N: drive are seen in event viewer. In previous Windows Servers, chkdsk results for drive C: ...
2
votes
2answers
231 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
1
vote
3answers
636 views

Windows Server 2003: start program on event in event viewer

With windows server 2008 you can start a program using scheduled task triggered by event on event viewer. Is there a way to emulate this with Windows Server 2003? Thank you in advance
1
vote
1answer
2k views

Is it possible to filter out (remove) a single Event ID from the Event Viewer?

Let's say I want to remove a single event from the view so I can view the rest. How do I accomplish this? This is on a Server 2003 R2 box.
1
vote
2answers
6k views

WinXP Event Viewer: Internet Explorer - how to log events?

I'm trying to debug a strange rendering/interaction issue with a web application in IE and thought I'd peek at the event viewer in Windows (XP) to see if anything odd was happening at the same time. ...
1
vote
1answer
87 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
1
vote
1answer
65 views

I set up email alerts in event viewer for 4624. How do I turn them off now?

My inbox is now flooded with alerts as someone added a share that is causing 4624's to be fired every few seconds. I thought I set up the alert under the event viewer. but I don't see where or how to ...
1
vote
1answer
3k views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
1
vote
2answers
1k views

Monitor state of “Startup Type” of services

I would like to be able to monitor when the state of "Startup Type" for a particular service is changed from Automatic to Manual. I haven't been able to find an event that is triggered in event ...
1
vote
1answer
157 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...