"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
0answers
15 views

Recommended Storage for Domain Controller Collecting Audit Logs

I am currently working with a customer on getting their Windows audit logs to our SIEM. Since the customer is unwilling/unable to provide hostnames for each host in the environment, I have suggested ...
0
votes
1answer
25 views

How to tell who made this change?

How do I tell who made the change in the following event log entry? What/who is Caller User Name? XXXXTE-MAIL (without the $) is the computer name of the domain controller. This entry is from the ...
1
vote
1answer
15 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
4
votes
2answers
52 views

How to filter the Windows Security event log by SID?

I want to filter the event log for a certain user, but I don't think there's an option to search by SAMID. There is a filter by UserId though, according to here. Is the following correct syntax ...
0
votes
0answers
15 views

Trying to filter AccessList = %%1537 in event viewer :/

I've got file auditing enabled and I'd like to be able to filter for a given user action. I have set up an XML filter that's pretty basic, but I can't seem to get it to work. I've got it working with ...
0
votes
1answer
30 views

Do DFS logs contain folder permission changes?

I have a DFS server sharing files and want to see when an admin gave read/write/full control to a user in a DFS share. Is there any way I can view this? I have checked in C:\Windows\Debug but the log ...
1
vote
0answers
29 views

Why is Windows Security Log using different formats on machines that seem to be the same?

I have a group of like computers (Win 7) that I'm working on creating some event monitoring rules around but I noticed something odd about what I'm receiving. One machine in the group is returning ...
0
votes
0answers
12 views

dropped security events on PDC

Running a Windows 2008R2 Active Directory environment geographically dispersed over WAN links. Have used group policy to apply increased verbose security logging on domain controllers. Using ...
0
votes
1answer
113 views

PowerShell script generates lots of warnings in Windows Event Log

I have a - rather complex - PowerShell script running on a Windows Server 2008 R2. When executing the script in the ISE or also in the console, everything runs fine. No errors or anything else that ...
1
vote
0answers
27 views

Run scheduled task on wireless connection

I'm trying to set up a completely wireless office, with mostly Windows 7 and a few Windows 8 clients, and one problem I've run into is login scripts. The security guys don't want to allow machine ...
10
votes
2answers
632 views

What are the implications of exceeding 4 GB in a Windows Event Log?

I found this Microsoft KB that covers recommended Event Log setting maximums for operating systems up to Windows 2008/Vista, which recommends a maximum of 4GB, and have seen some other vague ...
0
votes
0answers
24 views

EventLog Source “Connect”. No events in EventLog

I'm baffled by this, as I can find no documentation on wether or not "Connect" or "Connection" is some kind of registered keyword for EventLog Sources. I'm trying to create an EventLog Source called ...
0
votes
0answers
66 views

How to find what is causing a Kernel EventTracing error in the Event Log?

I am troubleshooting a Kernel EventTracing: "session failed to start with the following error: 0xc0000011" that pops up too many times in my event log. Every solutions I found in google were very ...
3
votes
1answer
122 views

Does Windows log a “Member removed” event for security groups when an AD user account is deleted?

We have AD DS security auditing enabled on a Windows Server 2008r2 functional level domain. We use a third party tool to alert us to changes to our administrative group memberships. We recently ...
0
votes
0answers
28 views

How do I find the Orig lock Server info in LockoutStatus

I have a account which is keep locking out but this happens night time where we are not able to take logs or grab logs. So what I like to do is write a powershell script to take these logs for me. ...
0
votes
1answer
61 views

Find IP of computers using AD account

I cant seem to find a log that contains the info I want in AD. I want to log logon events so I can see each user login and where it came from, similar to the information logged when a user provides ...
0
votes
1answer
32 views

Exchange 2010 Storage limit - Change

If a mailbox limit is set, is it possible to find out when and who made the change, by searching through event logs, is there an event ID specific to this that can be searched for.
1
vote
1answer
90 views

What Event ID is generated when a scheduled task fails in Windows Server 2003?

If a scheduled task fails on Windows Server 2003, is anything written to the event log? And if so, what Event ID does it have so I can set an Event Trigger to look for it, and email me?
0
votes
1answer
542 views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
1
vote
0answers
29 views

Permission for creating an event source

I have a WCF logging service that can write to the event log. The only problem is that the event source it writes to has to already exist and it cannot create it because the app pool the service is ...
0
votes
0answers
161 views

Event Log Id 4673, SeTcbPrivilege

I am performing some tests with Windows 2012R2 clustering in a lab environment. Sometimes the cluster creation process times out and fails. When this happens, running the cluster validation test ...
3
votes
0answers
32 views

How do I get as much debugging info as possible out of the Network Policy Server (ias) service?

We are trying to authenticate a client on remote vpn, through a Meraki Z1 teleworker appliance. The Z1 is sending a proper request, the Network Policy Server (ias) service is apparently ...
2
votes
1answer
26 views

What is “Ticket Options” Referring to in Domain Controller Event Logs?

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request. AgentDevice=WindowsLog ...
1
vote
2answers
99 views

How to emulate Windows event logging in Ubuntu?

Assume you were to have a predominantly Windows enterprise environment and that you have a number of Ubuntu servers you need to integrate into that environment, while introducing as few new enterprise ...
3
votes
1answer
59 views

vSphere/ESX How to log migration event to guest Windows OS

On a vSphere/ESX environment, how to write (automated) migration events to the eventlog into the hosted Windows VM that has been migrated? So that the hosted OS is aware of the migration event, and ...
0
votes
0answers
16 views

Events still showing in Server Manager after Event Logs have been cleared

I've cleared the System, Application and Setup event logs and refreshed the events in Server Manager, yet the old events that I've deleted are still shown in Server Manager. I've Googled the issue, ...
0
votes
0answers
28 views

What if Security ID and Account Name differ on Windows Security Event Log

the latest MS Kerberos Vulnerability let us search our Security Event Logs for potential attackers. According to a technet article, to identify an attacker you have to search for non matching security ...
0
votes
1answer
126 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
118 views

Remote Desktop to local PC

In our organization we have a control that watches users who use high privilege Active Directory accounts to RDP into any server or workstation on our network. I recently enabled this control which ...
0
votes
1answer
344 views

Powershell use Get-WinEvent with hashtable to query very specific time range

I'm trying to make a powershell script that essentially automates the account lockout tools. ideally I'll be able to get a fairly efficient query that can identify recently locked out accounts then ...
0
votes
2answers
54 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
0
votes
1answer
468 views

Event ID: 2002 Source: IIS-W3SVC-PerfCounters on Windows Server 2012

My server is showing on Event Viewer this error every hour. Log Name: Application Source: Microsoft-Windows-IIS-W3SVC-PerfCounters Date: 03/10/14 9:07:42 Event ID: 2002 Task ...
0
votes
1answer
446 views

What time zone are the description timestamps in Windows Event log (UTC?)

Log Name: System Source: LsaSrv Date: <date> <time> Event ID: 45058 Task Category: Logon Cache Level: Information Keywords: Classic User: N/A Computer: computername.contoso.com ...
0
votes
1answer
168 views

How to find out file path of file on a network share drive?

I am using a small .NET application which integrates a file into another application, however, I keep getting the following error in EventViewer (part of the .NET application): "The specified path, ...
2
votes
1answer
471 views

Event ID 12240 on Windows Server 2012

I have a Windows Server 2012 and some virtual machines in it. Since last week some error events appears hourly on event viewer saying that the system cannot find a remote VHD file. This VHD file is ...
0
votes
0answers
13 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
3answers
576 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
1
vote
0answers
56 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
2
votes
2answers
4k views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
0
votes
1answer
75 views

Log Parser: Getting Unique Record Numbers

I've been playing with Log Parser the past few days, we're trying to retain specific event IDs from the security logs of our Domain Controllers. As these are high traffic volume logs, the data in them ...
1
vote
0answers
384 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
1
vote
0answers
379 views

Event Log service broken on Windows 8.1 dev machines

On two separate Windows 8.1 installations with Visual Studio 2013 installed, the event log service errors on any attempt to read from/write to it. When I open Event Viewer I get this message when ...
0
votes
0answers
137 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
-1
votes
1answer
423 views

Moving SQL Server 2008 R2 Logs Causing Access Denied Error

I have just tried moving the log location for the SQL server 2008 R2 logs as I have a fairly small System disk due to the massive size of the Winsxs folder, and now I am getting the following error in ...
2
votes
1answer
131 views

How to find core dumps mentioned in event log

When I search for the files the event log mentions they are not there. Well, the bottom one is there but there's no helpful information in that file. This event was created by the Windows Error ...
2
votes
1answer
691 views

WMI command line event log acess

Can someone explain me how to get access to arbitrary system logs in eventlog service files? Now I'm poking around WMI(wmic.exe) and trying to execute following commands: For system services like ...
1
vote
3answers
176 views

Event logs saved on network share

I'm currently working on a project and having problems with saving event logs where i specify them. My problem is i want to have them saved on our file-server in a specified folder, however they wont ...
1
vote
1answer
98 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
246 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
3
votes
2answers
859 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...