"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
0answers
23 views

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
0
votes
1answer
11 views

Windows 2012 Service Removal Log

I have a production server where an application is experiencing an issue. The psexec service is marked for deletion and I want to try and tie the deactivation of the service to the start of the issue. ...
1
vote
1answer
24 views

can't find source of user lockout

System "scanner" user keeps locking, and in event viewer there is blank space where is the source. In some cases there is an ip address, wich points to different printers or scanners, but there i ...
1
vote
1answer
8 views

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only ...
1
vote
1answer
20 views

Auditing Log is Full - Eventlog Archive GPO not working

I am trying to create an Archive for Eventlog but it does not seem to work. Server 2k12 R2 Environment. Following is the GPO I have enabled: I have rebooted the server and made sure it is being ...
0
votes
0answers
19 views

Windows - Log services access to certificate store

I have a software which run as a service (Checkpoint Identity Awareness) which connects to a server and verifies its identity (actually a checkpoint firewall) by checking its certificate, like any ...
0
votes
0answers
36 views

How to filter ObjectName in Windows logs with Advanced XML Filtering?

I want to deploy a centralized log analysis tool on my domain. I'm currently configuring Windows to audit a shared network drive (read, write, access attempt of domain users) to forward Windows events ...
2
votes
1answer
45 views

Auditing Registry events through AD

I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately ...
0
votes
2answers
104 views

Convert saved evtx files to text

I'm looking to export a large quantity of saved Security log files (.evtx) to text or CSV format. I found wevtutil but that only seems to be able to convert .evt to .evtx when dealing with saved log ...
0
votes
1answer
47 views

Windws Server 2012 R2 Event Log / Audit deleted files / Only last minutes visible

My goal: I want to find out who deletes files on a network share. Users are sometimes complaining that a file is missing and as usual the others are to blame. I have file auditing enabled for this ...
1
vote
1answer
44 views

Create EventLog Source using Group Policy

In our environment we want to force all our system engineers who write scripts to write logging to the EventLog. To keep track of all logging of our scripts we want to write this to a specific source ...
0
votes
1answer
39 views

AVR Boost Active (APCPBEAgen) Warnings Windows Server 2012 event log

I have a Windows Server 2012 running. In the event log I see constantly a warning from AVR Boost Active (APCPBEAgen). It appears approx. every 6 hours. Question Does anybody know what 'AVR Boost ...
1
vote
1answer
86 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0answers
23 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
0
votes
0answers
60 views

Windows task scheduler event viewer trigger 0x800704DD

I am creating a Windows task in Windows 2008 R2 for an Event Viewer event. I wish for it to display a dialog box. However the task will only trigger if a user is logged in. I wish for the task to ...
1
vote
1answer
80 views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
0
votes
1answer
95 views

How do you get detailed information on Active Directory logon failures?

In my domain controller event log, I'm getting an account failure from a username of a service account. The info is: Security ID: DOMAIN\serviceaccount Account Name: serviceaccount Additional ...
2
votes
1answer
20 views

Windows Logon Events Description

Is there like any portal/site where I can refer to for the detailed description for WEV logins? Eg. 4625 An account failed to log on, 4723 An attempt was made to change an account's password and 4741 ...
0
votes
1answer
31 views

Windows security event log showing lot of firewall rule changed alert

n my server i am getting lot of event id 4946. A change has been made to Windows Firewall exception list. A rule was added. i am getting this alert every day. can you help me to reslove this. Regards,...
0
votes
0answers
14 views

Event Forwarding

I am taking the MCITP 70-685 Windows 7 Enterprise Desktop Support Technician and am trying to set up Event Forwarding. My setup (As I need three separate OS' which I'm running on two computers) is ...
0
votes
1answer
94 views

windows event log forwarding permission

I am trying to set up an event log collector server in a Domain. I flowed the steps described here: http://zenshaze.com/wp/?p=57 I have added the NETWORK SERVICE to the Event Log Readers group to ...
1
vote
1answer
115 views

Windows event log export - how to get general description?

I am exporting windows Application event logs to XML from one of my servers for offline analysis. I am able to do this...but when I do, I lose the "General" description information. Here is an example ...
1
vote
0answers
83 views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
2
votes
0answers
144 views

Error 1606 - MSIs, UNC paths and permissions?

I have a persistent issue with a number of our Windows desktop systems where we see various MSI packages throw up error 1606 (and 1314, in the MSI log), which is a permission issue, when attempting to ...
1
vote
1answer
69 views

What is “Report ID” in Windows Application Error, event 1000 correlated to?

I'm analyzing an event 1000 error in a third-party enterprise application which shows a "Faulting module name" of ntdll.dll and wondering: What is the "Report ID" GUID correlated to? and How might I ...
-1
votes
1answer
21 views

EventLog “Access Denied” after installing an additional DC in a 2012 environment

After promoting a new DC into an existing domain, Eventviewer shows the following: I might as well mention that the Installation itself did not experience any issues When looking at the C:\Windows\...
0
votes
1answer
72 views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
0
votes
0answers
18 views

Windows Log size Policy

I have implement the policy for Windows log size as follows ( Please see the print-screen ) But, when i click on Event Viewer -- Application -- Properties, i see below size ( please see below print-...
1
vote
0answers
396 views

Event log subscription returns error code (0x138C)

I have been battling getting Event log subscriptions to work on my server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1answer
85 views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
0
votes
1answer
35 views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
0
votes
0answers
57 views

No event ID 4625 for administrator account

I'm having an issue where no 4625 Event is logged when I type an incorrect password for the domain administrator account when attempting to login to a domain controller via remote desktop. If I use a ...
0
votes
0answers
14 views

Same printout appeared on multiple local printers on intranet

I work for a small retail chain. Each location has a windows pc with a usb printer. The machines are on the same windows domain through vpn. Monday morning all the stores in one city discovered a ...
0
votes
1answer
31 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW ...
1
vote
1answer
208 views

Wevtutil equivalent for powershell script to get event logs

I have made a powershell script which is as below but since I won't be able to save it in .evtx format. I want the wevtutil equivalent(using wevtutil epl) for the same.Please help! $ErrorTime=Get-...
0
votes
1answer
94 views

SideBySide Event ID 63 Error ~ Microsoft SQL Server

I am getting the following repeating errors in event viewer: Does anybody know what is causing these errors and how to fix them?
0
votes
0answers
30 views

client can't connect to sftp server, can that be due to Event ID 7036: The Application Experience service entered the stopped/running state?

I have a sftp server running in Windows Server 2008R2. A client said they tried to connect to the server several times, but failed. My colleagues and others can connect and use the sftp. The next ...
0
votes
0answers
85 views

How to forward UserData field with nxlog?

I have a simple nxlog configuration that writes applocker events to a file as JSON. The events are captured: <Input applocker> Module im_msvistalog Query <QueryList>\ ...
0
votes
2answers
156 views

Log username of who restarts a service

I'm looking for a simple way to log the username of someone that restarts a service on a server. This was possible in 2003, but I do not see a possibility in 2008 and 2012.
1
vote
1answer
115 views

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems? Does it automatically delete old logs when disk is full. Any way to define log retention period? (e.g. ...
2
votes
1answer
113 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
0
votes
1answer
363 views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go wrong?...
0
votes
1answer
57 views

Auditing for User/Machine account logon/logoff events in Child Domain ONLY

I have searched high and low and cannot find an answer to my need. I am in the process of setting up a SIEM for our network and I need to audit for user and machine logon/logoff events. Simple enough ...
0
votes
1answer
154 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
1
vote
0answers
153 views

Strange behavior with Dell Openmanage 8.2 and server 2008 R2 64bit and degraded RAID

I recently had to rebuild a domain controller [DC02] due to AD database being corrupted and not repairable. Additionally, this server had a degraded RAID [RAID 1] due to a hard drive failure. I had to ...
0
votes
2answers
119 views

Windows Event ID 6011

I am looking into how to track when a computer was renamed and by who. I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period ...
0
votes
1answer
440 views

AdsmClientService Event ID 4099

I'm getting a bunch of this erorr message in our server: ANS4987E Error processing '\FE01\c$\Windows\System32\config\RegBack\SECURITY': the object is in use by another process The server has ...
3
votes
1answer
72 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
2
votes
0answers
30 views

Pass null arguments in an scheduled task xml file

I am trying to run a batch file when some specific events occurs and I want to pass some null arguments to one of my tasks. The problem is that I don't know how. I have tried a lot of combinations ...
0
votes
1answer
8k views

Event ID: 36888 The following fatal alert was generated: 10. The internal error state is 10

We are experiencing the following schannel errors most frequently on our Remote Desktop Terminal Servers. Log Name: System Source: Schannel Date: 11/18/2015 1:04:56 PM Event ID:...