"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
1answer
16 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0answers
19 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
0
votes
0answers
38 views

Windows task scheduler event viewer trigger 0x800704DD

I am creating a Windows task in Windows 2008 R2 for an Event Viewer event. I wish for it to display a dialog box. However the task will only trigger if a user is logged in. I wish for the task to ...
1
vote
1answer
30 views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
0
votes
1answer
49 views

How do you get detailed information on Active Directory logon failures?

In my domain controller event log, I'm getting an account failure from a username of a service account. The info is: Security ID: DOMAIN\serviceaccount Account Name: serviceaccount Additional ...
2
votes
1answer
20 views

Windows Logon Events Description

Is there like any portal/site where I can refer to for the detailed description for WEV logins? Eg. 4625 An account failed to log on, 4723 An attempt was made to change an account's password and 4741 ...
0
votes
1answer
24 views

Windows security event log showing lot of firewall rule changed alert

n my server i am getting lot of event id 4946. A change has been made to Windows Firewall exception list. A rule was added. i am getting this alert every day. can you help me to reslove this. ...
0
votes
0answers
11 views

Event Forwarding

I am taking the MCITP 70-685 Windows 7 Enterprise Desktop Support Technician and am trying to set up Event Forwarding. My setup (As I need three separate OS' which I'm running on two computers) is ...
0
votes
1answer
57 views

windows event log forwarding permission

I am trying to set up an event log collector server in a Domain. I flowed the steps described here: http://zenshaze.com/wp/?p=57 I have added the NETWORK SERVICE to the Event Log Readers group to ...
1
vote
1answer
68 views

Windows event log export - how to get general description?

I am exporting windows Application event logs to XML from one of my servers for offline analysis. I am able to do this...but when I do, I lose the "General" description information. Here is an example ...
1
vote
0answers
76 views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
2
votes
0answers
87 views

Error 1606 - MSIs, UNC paths and permissions?

I have a persistent issue with a number of our Windows desktop systems where we see various MSI packages throw up error 1606 (and 1314, in the MSI log), which is a permission issue, when attempting to ...
1
vote
1answer
30 views

What is “Report ID” in Windows Application Error, event 1000 correlated to?

I'm analyzing an event 1000 error in a third-party enterprise application which shows a "Faulting module name" of ntdll.dll and wondering: What is the "Report ID" GUID correlated to? and How might I ...
-1
votes
1answer
18 views

EventLog “Access Denied” after installing an additional DC in a 2012 environment

After promoting a new DC into an existing domain, Eventviewer shows the following: I might as well mention that the Installation itself did not experience any issues When looking at the ...
0
votes
1answer
32 views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
0
votes
0answers
18 views

Windows Log size Policy

I have implement the policy for Windows log size as follows ( Please see the print-screen ) But, when i click on Event Viewer -- Application -- Properties, i see below size ( please see below ...
1
vote
0answers
201 views

Event log subscription returns error code (0x138C)

I have been battling getting Event log subscriptions to work on my server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1answer
53 views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
0
votes
1answer
30 views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
0
votes
0answers
46 views

No event ID 4625 for administrator account

I'm having an issue where no 4625 Event is logged when I type an incorrect password for the domain administrator account when attempting to login to a domain controller via remote desktop. If I use a ...
0
votes
0answers
14 views

Same printout appeared on multiple local printers on intranet

I work for a small retail chain. Each location has a windows pc with a usb printer. The machines are on the same windows domain through vpn. Monday morning all the stores in one city discovered a ...
0
votes
1answer
27 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW ...
1
vote
1answer
155 views

Wevtutil equivalent for powershell script to get event logs

I have made a powershell script which is as below but since I won't be able to save it in .evtx format. I want the wevtutil equivalent(using wevtutil epl) for the same.Please help! ...
0
votes
1answer
69 views

SideBySide Event ID 63 Error ~ Microsoft SQL Server

I am getting the following repeating errors in event viewer: Does anybody know what is causing these errors and how to fix them?
0
votes
0answers
26 views

client can't connect to sftp server, can that be due to Event ID 7036: The Application Experience service entered the stopped/running state?

I have a sftp server running in Windows Server 2008R2. A client said they tried to connect to the server several times, but failed. My colleagues and others can connect and use the sftp. The next ...
0
votes
0answers
54 views

How to forward UserData field with nxlog?

I have a simple nxlog configuration that writes applocker events to a file as JSON. The events are captured: <Input applocker> Module im_msvistalog Query <QueryList>\ ...
0
votes
2answers
105 views

Log username of who restarts a service

I'm looking for a simple way to log the username of someone that restarts a service on a server. This was possible in 2003, but I do not see a possibility in 2008 and 2012.
1
vote
1answer
86 views

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems? Does it automatically delete old logs when disk is full. Any way to define log retention period? (e.g. ...
2
votes
1answer
93 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
0
votes
1answer
205 views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go ...
0
votes
1answer
49 views

Auditing for User/Machine account logon/logoff events in Child Domain ONLY

I have searched high and low and cannot find an answer to my need. I am in the process of setting up a SIEM for our network and I need to audit for user and machine logon/logoff events. Simple enough ...
0
votes
1answer
101 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
1
vote
0answers
150 views

Strange behavior with Dell Openmanage 8.2 and server 2008 R2 64bit and degraded RAID

I recently had to rebuild a domain controller [DC02] due to AD database being corrupted and not repairable. Additionally, this server had a degraded RAID [RAID 1] due to a hard drive failure. I had to ...
0
votes
2answers
95 views

Windows Event ID 6011

I am looking into how to track when a computer was renamed and by who. I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period ...
0
votes
1answer
296 views

AdsmClientService Event ID 4099

I'm getting a bunch of this erorr message in our server: ANS4987E Error processing '\FE01\c$\Windows\System32\config\RegBack\SECURITY': the object is in use by another process The server has ...
3
votes
1answer
55 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
2
votes
0answers
29 views

Pass null arguments in an scheduled task xml file

I am trying to run a batch file when some specific events occurs and I want to pass some null arguments to one of my tasks. The problem is that I don't know how. I have tried a lot of combinations ...
0
votes
1answer
4k views

Event ID: 36888 The following fatal alert was generated: 10. The internal error state is 10

We are experiencing the following schannel errors most frequently on our Remote Desktop Terminal Servers. Log Name: System Source: Schannel Date: 11/18/2015 1:04:56 PM Event ...
1
vote
1answer
28 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
2
votes
0answers
330 views

New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts

I am researching a failed login issue that is triggering our monitoring software. Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
0
votes
0answers
44 views

Windows Event Log Service Crash

I have an Active Directory Domain with Win2008R2 DCs and Win7 clients. From about 2 months ago some of my clients are complaining one after another about time of their systems which is behind the DC ...
2
votes
0answers
823 views

The Diagnostic Service Host failed to start due to the following error

I am receiving the following error in my System event log: Service Control Manager, Event ID 7000 The Diagnostic Service Host failed to start due to the following error: A privilege that the ...
0
votes
0answers
72 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
1
vote
2answers
74 views

Waht could cause the eventlog service to consume memory?

I'm running a bunch of Windows Server 2008 R2 on a 64 bits hardware. I recently noticed that the eventlog service is going wild about memory consumption. The service on its own can consume about 4GB ...
0
votes
0answers
283 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
4
votes
3answers
152 views

Where can I see what calls of EXE-programs have been made (including the arguments)?

Is there any log-file within Windows where all EXE-calls are tracked or is it possible to enable such a log? Would this contain the arguments / parameters of these calls? Thanks
0
votes
0answers
39 views

AD DS audit event log when using RSAT

Got a query about AD DS audit event log when using Remote Server Administration Tools (AD User and Computer tool) On DC, already turn on Audit log for AD DS change (enable, disable, create, delete ...
0
votes
0answers
28 views

Windows Server 2008 HPC Edition is permanently logging Audit Success for RDP sessions

A Windows Server 2008 HPC Edition box is permanently logging Logon and Logoff tasks for the user who is connected to it via RDP every few seconds. Is there a way to just log the user initiated logon ...
0
votes
0answers
19 views

Server2012 Eventlogs details xml copy

Good day, I have a question if its possible to extract Provider name from event log. ValueQueries Value name="EventRecordID">Event/System/EventRecordID /Value /ValueQueries By this I managed ...
1
vote
1answer
70 views

How to log the IP that connects from outside of company to terminal server?

We have users RDP to company's terminal servers. Is there a way that I can track the ip address outside of company where users connect from? I know there are logs avaliable under under terminal ...