"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
1answer
16 views

Track down source of event 4771: Kerberos pre-authentication failed

Some process on a remote server is generating failed log-on attempts for a specific user account. I want to know what process it is. The account in question started generating these bad password ...
0
votes
1answer
15 views

AD log message showing E-mail of user object creation

I am referencing the active directory log message (4720) which shows 'User Principal Name' as an email address. However there is another email address found when viewing the actual User Object ...
3
votes
1answer
36 views

Windows Events for Remote Desktop logon failure

According to ref the logon types 10 and 3 in windows events are represnting Logon Type 10 = RemoteInteractive Logon & Logon Type 3 = Network Logon But when i tried to connect a Windows machine ...
0
votes
1answer
41 views

What does Microsoft-Windows-Security-Auditing event with NULL SID mean?

On a Windows Server 2012 machine, in Event Viewer, there was some unusual behaviour on a system, a service was stopping and I was unsure if it "stopped itself" or was forced to stop by a user action. ...
1
vote
0answers
41 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
0
votes
0answers
260 views

I can't find information on 2012 R2 Event ID's 257, 258, 265 Win32K errors

2012 R2 as a Hyper-V host only Last night this machine began running very slowly. I shut down the VM's and then the host. That also took forever. When I restarted the vm host machine it operated ...
1
vote
2answers
37 views

Check backpressure live on Exchange2010 server

I am working a lot with exchange servers at the moment and would like to make sure there is no backpressure built up on them. Right know I have a powershell script running every 4h to check the ...
0
votes
1answer
52 views

Event viewer missing logs following unexpected reboot

One of our Server 2012 boxes lost power unexpectedly recently. We're still not sure how it happened, but given its suddenness I suspect someone in the data centre tripped over a power cable. I went ...
0
votes
2answers
56 views

Forwarding Application and Services Logs using nxlog

Using nxlog 'im_mseventlog' module I'm able to forward all Windows Logs (Application, Security, System... ) logs to the remote syslog server. But I'm not able to forward eventlogs present under ...
1
vote
2answers
44 views

How to retrieve previous IP/DNS information from Domain Controller logs?

I unfortunately have DNS scavenging on; information I need to retrieve could have been in Event Viewer DNS logs, but that's not there anymore, or maybe I am not looking for it properly. Story: I ...
2
votes
2answers
322 views

Windows Server restart / shutdown history

How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed? The Windows Event Log is ...
1
vote
0answers
77 views

AD DC - Error 4625 Status 0x80090308

I recognzie a small amount of Event 4625 entries with a status of 0x80090308 and substatus 0x0; 2% over all 4625's. It is basically a failed logon but without any information I could use to look ...
0
votes
0answers
60 views

How to fix: The description for event ID %i from source %s cannot be found?

I need to troubleshoot some WMI crashes we are suffering from. Unfortunately the event log doesn't show any details as the descriptions are missing. This is what the log says: The description for ...
0
votes
0answers
54 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
0
votes
0answers
40 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
0
votes
0answers
52 views

Windows Event Log folder permissions change after wevtutil clear

After running the following as administrator: wevtutil cl System /bu:c:\backup\log.evtx I notice that the permissions on C:\windows\system32\winevt\Logs change and eventlog service account no ...
0
votes
0answers
65 views

How can i create a trigger for a task in task scheduler which should start the task for some event ID but not for some other event ID

I have a few tasks created in task scheduler for which i wish to create auto recovery mechanism if the tasks are terminated from outside the task scheduler. Basically each of these tasks create a java ...
2
votes
1answer
155 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
1
vote
0answers
78 views

Using WMI to query Windows Event Collector logs

Using WMI to query the eventlog is quite simple, using Win32_NTLogEvent, for example: Get-WmiObject -query "SELECT *FROM Win32_NTLogEvent WHERE (logfile='Application' and SourceName='Something') ...
0
votes
0answers
67 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
1
vote
0answers
50 views

Windows Forwarded Events date filter not working

I have a Windows Server 2008 R2 configured to receive forwarded events from a large amount of clients (Windows 7\8.1). It receives events in the event ID range of 8000-8006 from the WLAN-Autoconfig ...
1
vote
1answer
93 views

Why are DHCP leases not included in DHCP Log?

Running Windows Server 2008r2. DHCP Logging is enabled (Server Manager, Roles, DHCP Server, , IPv4, Properties, General, Enable DHCP Audit Logging). In the DHCP event log (Event Viewer, Custom ...
1
vote
1answer
239 views

How could I send the windows eventlog to the network logging of a linux server?

In Windows, I am using the "Eventlog to Syslog" utility to send event logs to the Linux syslog server (syslog-ng). But I am can't do the same with some log files, especially in the case of the IIS ...
0
votes
1answer
44 views

How to redirect IIS logs to windows event logs in windows 7

I am using windows 7 OS with IIS 7.5 I need to redirect the IIS log files to the Windows Event Log. In IIS 8.5 there is an option to perform the above operation, but I require that to be done in IIS ...
1
vote
0answers
116 views

How do I get more information in these event log entries? (values instead of parameter names)

We occasionally see entries like these in the event log: Faulting application name: w3wp.exe, version: 8.5.9600.16384, time stamp: 0x52157ba0 Faulting module name: KERNELBASE.dll, version: ...
0
votes
1answer
2k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
0answers
292 views

Windows EventLog Event ID 1074 - wrong user named?

Short Version If a Windows server is rebooted automatically (ex: as the result of Windows updates being applied) and there is a disconnected RDP session on that machine, is it possible that the ...
0
votes
1answer
33 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
1
vote
1answer
77 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
4
votes
2answers
331 views

How to filter the Windows Security event log by SID?

I want to filter the event log for a certain user, but I don't think there's an option to search by SAMID. There is a filter by UserId though, according to here. Is the following correct syntax ...
1
vote
1answer
67 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
0
votes
1answer
129 views

Do DFS logs contain folder permission changes?

I have a DFS server sharing files and want to see when an admin gave read/write/full control to a user in a DFS share. Is there any way I can view this? I have checked in C:\Windows\Debug but the log ...
1
vote
0answers
179 views

Why is Windows Security Log using different formats on machines that seem to be the same?

I have a group of like computers (Win 7) that I'm working on creating some event monitoring rules around but I noticed something odd about what I'm receiving. One machine in the group is returning ...
0
votes
0answers
17 views

dropped security events on PDC

Running a Windows 2008R2 Active Directory environment geographically dispersed over WAN links. Have used group policy to apply increased verbose security logging on domain controllers. Using ...
0
votes
1answer
372 views

PowerShell script generates lots of warnings in Windows Event Log

I have a - rather complex - PowerShell script running on a Windows Server 2008 R2. When executing the script in the ISE or also in the console, everything runs fine. No errors or anything else that ...
1
vote
0answers
50 views

Run scheduled task on wireless connection

I'm trying to set up a completely wireless office, with mostly Windows 7 and a few Windows 8 clients, and one problem I've run into is login scripts. The security guys don't want to allow machine ...
10
votes
2answers
1k views

What are the implications of exceeding 4 GB in a Windows Event Log?

I found this Microsoft KB that covers recommended Event Log setting maximums for operating systems up to Windows 2008/Vista, which recommends a maximum of 4GB, and have seen some other vague ...
0
votes
0answers
25 views

EventLog Source “Connect”. No events in EventLog

I'm baffled by this, as I can find no documentation on wether or not "Connect" or "Connection" is some kind of registered keyword for EventLog Sources. I'm trying to create an EventLog Source called ...
0
votes
0answers
121 views

How to find what is causing a Kernel EventTracing error in the Event Log?

I am troubleshooting a Kernel EventTracing: "session failed to start with the following error: 0xc0000011" that pops up too many times in my event log. Every solutions I found in google were very ...
3
votes
1answer
540 views

Does Windows log a “Member removed” event for security groups when an AD user account is deleted?

We have AD DS security auditing enabled on a Windows Server 2008r2 functional level domain. We use a third party tool to alert us to changes to our administrative group memberships. We recently ...
0
votes
1answer
106 views

How do I find the Orig lock Server info in LockoutStatus

I have a account which is keep locking out but this happens night time where we are not able to take logs or grab logs. So what I like to do is write a powershell script to take these logs for me. ...
0
votes
1answer
88 views

Find IP of computers using AD account

I cant seem to find a log that contains the info I want in AD. I want to log logon events so I can see each user login and where it came from, similar to the information logged when a user provides ...
0
votes
1answer
46 views

How to find out which admin made a change in Exchange 2010

If a mailbox limit is set, is it possible to find out when and who made the change, by searching through event logs, is there an event ID specific to this that can be searched for.
1
vote
1answer
253 views

What Event ID is generated when a scheduled task fails in Windows Server 2003?

If a scheduled task fails on Windows Server 2003, is anything written to the event log? And if so, what Event ID does it have so I can set an Event Trigger to look for it, and email me?
0
votes
1answer
3k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
2
votes
0answers
80 views

Permission for creating an event source

I have a WCF logging service that can write to the event log. The only problem is that the event source it writes to has to already exist and it cannot create it because the app pool the service is ...
0
votes
0answers
259 views

Event Log Id 4673, SeTcbPrivilege

I am performing some tests with Windows 2012R2 clustering in a lab environment. Sometimes the cluster creation process times out and fails. When this happens, running the cluster validation test ...
4
votes
0answers
50 views

How do I get as much debugging info as possible out of the Network Policy Server (ias) service?

We are trying to authenticate a client on remote vpn, through a Meraki Z1 teleworker appliance. The Z1 is sending a proper request, the Network Policy Server (ias) service is apparently ...
2
votes
1answer
72 views

What is “Ticket Options” Referring to in Domain Controller Event Logs?

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request. AgentDevice=WindowsLog ...
1
vote
2answers
127 views

How to emulate Windows event logging in Ubuntu?

Assume you were to have a predominantly Windows enterprise environment and that you have a number of Ubuntu servers you need to integrate into that environment, while introducing as few new enterprise ...