"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

2
votes
1answer
31 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
1
vote
0answers
8 views

Using WMI to query Windows Event Collector logs

Using WMI to query the eventlog is quite simple, using Win32_NTLogEvent, for example: Get-WmiObject -query "SELECT *FROM Win32_NTLogEvent WHERE (logfile='Application' and SourceName='Something') ...
0
votes
0answers
34 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
1
vote
0answers
20 views

Windows Forwarded Events date filter not working

I have a Windows Server 2008 R2 configured to receive forwarded events from a large amount of clients (Windows 7\8.1). It receives events in the event ID range of 8000-8006 from the WLAN-Autoconfig ...
1
vote
1answer
37 views

Why are DHCP leases not included in DHCP Log?

Running Windows Server 2008r2. DHCP Logging is enabled (Server Manager, Roles, DHCP Server, , IPv4, Properties, General, Enable DHCP Audit Logging). In the DHCP event log (Event Viewer, Custom ...
1
vote
1answer
45 views

How could I send the windows eventlog to the network logging of a linux server?

In Windows, I am using the "Eventlog to Syslog" utility to send event logs to the Linux syslog server (syslog-ng). But I am can't do the same with some log files, especially in the case of the IIS ...
0
votes
1answer
25 views

How to redirect IIS logs to windows event logs in windows 7

I am using windows 7 OS with IIS 7.5 I need to redirect the IIS log files to the Windows Event Log. In IIS 8.5 there is an option to perform the above operation, but I require that to be done in IIS ...
1
vote
0answers
17 views

How do I get more information in these event log entries? (values instead of parameter names)

We occasionally see entries like these in the event log: Faulting application name: w3wp.exe, version: 8.5.9600.16384, time stamp: 0x52157ba0 Faulting module name: KERNELBASE.dll, version: ...
0
votes
1answer
306 views

Event 4625 Audit Failure NULL SID failed network logons

In a small environment comprised of one Windows Small Business Server 2011 server of relatively limited use (domain controller / Active Directory and DNS, Group Policy, DHCP, file server, print ...
0
votes
0answers
34 views

Windows EventLog Event ID 1074 - wrong user named?

Short Version If a Windows server is rebooted automatically (ex: as the result of Windows updates being applied) and there is a disconnected RDP session on that machine, is it possible that the ...
0
votes
1answer
27 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
1
vote
1answer
29 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
4
votes
2answers
90 views

How to filter the Windows Security event log by SID?

I want to filter the event log for a certain user, but I don't think there's an option to search by SAMID. There is a filter by UserId though, according to here. Is the following correct syntax ...
0
votes
0answers
25 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
0
votes
1answer
45 views

Do DFS logs contain folder permission changes?

I have a DFS server sharing files and want to see when an admin gave read/write/full control to a user in a DFS share. Is there any way I can view this? I have checked in C:\Windows\Debug but the log ...
1
vote
0answers
46 views

Why is Windows Security Log using different formats on machines that seem to be the same?

I have a group of like computers (Win 7) that I'm working on creating some event monitoring rules around but I noticed something odd about what I'm receiving. One machine in the group is returning ...
0
votes
0answers
15 views

dropped security events on PDC

Running a Windows 2008R2 Active Directory environment geographically dispersed over WAN links. Have used group policy to apply increased verbose security logging on domain controllers. Using ...
0
votes
1answer
174 views

PowerShell script generates lots of warnings in Windows Event Log

I have a - rather complex - PowerShell script running on a Windows Server 2008 R2. When executing the script in the ISE or also in the console, everything runs fine. No errors or anything else that ...
1
vote
0answers
32 views

Run scheduled task on wireless connection

I'm trying to set up a completely wireless office, with mostly Windows 7 and a few Windows 8 clients, and one problem I've run into is login scripts. The security guys don't want to allow machine ...
10
votes
2answers
684 views

What are the implications of exceeding 4 GB in a Windows Event Log?

I found this Microsoft KB that covers recommended Event Log setting maximums for operating systems up to Windows 2008/Vista, which recommends a maximum of 4GB, and have seen some other vague ...
0
votes
0answers
25 views

EventLog Source “Connect”. No events in EventLog

I'm baffled by this, as I can find no documentation on wether or not "Connect" or "Connection" is some kind of registered keyword for EventLog Sources. I'm trying to create an EventLog Source called ...
0
votes
0answers
102 views

How to find what is causing a Kernel EventTracing error in the Event Log?

I am troubleshooting a Kernel EventTracing: "session failed to start with the following error: 0xc0000011" that pops up too many times in my event log. Every solutions I found in google were very ...
3
votes
1answer
204 views

Does Windows log a “Member removed” event for security groups when an AD user account is deleted?

We have AD DS security auditing enabled on a Windows Server 2008r2 functional level domain. We use a third party tool to alert us to changes to our administrative group memberships. We recently ...
0
votes
1answer
52 views

How do I find the Orig lock Server info in LockoutStatus

I have a account which is keep locking out but this happens night time where we are not able to take logs or grab logs. So what I like to do is write a powershell script to take these logs for me. ...
0
votes
1answer
65 views

Find IP of computers using AD account

I cant seem to find a log that contains the info I want in AD. I want to log logon events so I can see each user login and where it came from, similar to the information logged when a user provides ...
0
votes
1answer
33 views

Exchange 2010 Storage limit - Change

If a mailbox limit is set, is it possible to find out when and who made the change, by searching through event logs, is there an event ID specific to this that can be searched for.
1
vote
1answer
135 views

What Event ID is generated when a scheduled task fails in Windows Server 2003?

If a scheduled task fails on Windows Server 2003, is anything written to the event log? And if so, what Event ID does it have so I can set an Event Trigger to look for it, and email me?
0
votes
1answer
1k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
1
vote
0answers
33 views

Permission for creating an event source

I have a WCF logging service that can write to the event log. The only problem is that the event source it writes to has to already exist and it cannot create it because the app pool the service is ...
0
votes
0answers
200 views

Event Log Id 4673, SeTcbPrivilege

I am performing some tests with Windows 2012R2 clustering in a lab environment. Sometimes the cluster creation process times out and fails. When this happens, running the cluster validation test ...
3
votes
0answers
35 views

How do I get as much debugging info as possible out of the Network Policy Server (ias) service?

We are trying to authenticate a client on remote vpn, through a Meraki Z1 teleworker appliance. The Z1 is sending a proper request, the Network Policy Server (ias) service is apparently ...
2
votes
1answer
31 views

What is “Ticket Options” Referring to in Domain Controller Event Logs?

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request. AgentDevice=WindowsLog ...
1
vote
2answers
105 views

How to emulate Windows event logging in Ubuntu?

Assume you were to have a predominantly Windows enterprise environment and that you have a number of Ubuntu servers you need to integrate into that environment, while introducing as few new enterprise ...
3
votes
1answer
65 views

vSphere/ESX How to log migration event to guest Windows OS

On a vSphere/ESX environment, how to write (automated) migration events to the eventlog into the hosted Windows VM that has been migrated? So that the hosted OS is aware of the migration event, and ...
0
votes
0answers
17 views

Events still showing in Server Manager after Event Logs have been cleared

I've cleared the System, Application and Setup event logs and refreshed the events in Server Manager, yet the old events that I've deleted are still shown in Server Manager. I've Googled the issue, ...
0
votes
0answers
30 views

What if Security ID and Account Name differ on Windows Security Event Log

the latest MS Kerberos Vulnerability let us search our Security Event Logs for potential attackers. According to a technet article, to identify an attacker you have to search for non matching security ...
0
votes
1answer
157 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
136 views

Remote Desktop to local PC

In our organization we have a control that watches users who use high privilege Active Directory accounts to RDP into any server or workstation on our network. I recently enabled this control which ...
0
votes
1answer
383 views

Powershell use Get-WinEvent with hashtable to query very specific time range

I'm trying to make a powershell script that essentially automates the account lockout tools. ideally I'll be able to get a fairly efficient query that can identify recently locked out accounts then ...
0
votes
2answers
64 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
0
votes
1answer
608 views

Event ID: 2002 Source: IIS-W3SVC-PerfCounters on Windows Server 2012

My server is showing on Event Viewer this error every hour. Log Name: Application Source: Microsoft-Windows-IIS-W3SVC-PerfCounters Date: 03/10/14 9:07:42 Event ID: 2002 Task ...
0
votes
1answer
554 views

What time zone are the description timestamps in Windows Event log (UTC?)

Log Name: System Source: LsaSrv Date: <date> <time> Event ID: 45058 Task Category: Logon Cache Level: Information Keywords: Classic User: N/A Computer: computername.contoso.com ...
0
votes
1answer
215 views

How to find out file path of file on a network share drive?

I am using a small .NET application which integrates a file into another application, however, I keep getting the following error in EventViewer (part of the .NET application): "The specified path, ...
2
votes
1answer
593 views

Event ID 12240 on Windows Server 2012

I have a Windows Server 2012 and some virtual machines in it. Since last week some error events appears hourly on event viewer saying that the system cannot find a remote VHD file. This VHD file is ...
0
votes
0answers
13 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
3answers
677 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
1
vote
0answers
71 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
2
votes
2answers
4k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
0
votes
1answer
89 views

Log Parser: Getting Unique Record Numbers

I've been playing with Log Parser the past few days, we're trying to retain specific event IDs from the security logs of our Domain Controllers. As these are high traffic volume logs, the data in them ...
1
vote
0answers
434 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...