47 votes
Accepted

Find out who disabled a Windows service

When the start type of a service is changed, an event is recorded in the system event log , with id 7040 and source Service Control Manager. The user that performed the operation is displayed in the ...
JFL's user avatar
  • 2,028
14 votes

Find out who disabled a Windows service

In Event Viewer, look in the "Windows Logs"->"System" event log, and filter for Source "Service Control Manager" and Event ID 7040. Find the event saying "The start type of the service was changed ...
Pak's user avatar
  • 919
13 votes

Where are windows 10 defender offline scan logs/results?

Windows Defender adds entries to the Event Viewer in the following location: Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> Windows Defender >> Operational Where you'll ...
jamiet147's user avatar
  • 165
12 votes

How to filter windows event log with wildcard?

Use Powershell Get-EventLog -LogName "System" | ?{$_.Message -like "*YourSearchString*"} | Out-GridView
ult's user avatar
  • 121
11 votes

Where are windows 10 defender offline scan logs/results?

According to Microsoft, any threats detected by the offline scanner will show up in the Threat History (where the online scanner also records any viruses found): Where can I find scan results? ...
Christian's user avatar
  • 111
11 votes
Accepted

Windows event codes for startup/shutdown lock/unlock

Refering to your request about starting and shutdown event IDs, I made the list below based on a Windows 10 machine. The main point is that depending on the shutdown action (planned reboot, planned ...
Michel de Crevoisier's user avatar
10 votes

How to enable Audit Failure logs in Active Directory?

Note that in Win2008 server and above, you need to use the "Advanced Audit Policy Configuration" options in the GPO. See screenshot:
KERR's user avatar
  • 435
6 votes

Where in the event log is the IIS AppPool recycling events being recorded?

Event viewer / Custom views / Server Roles / Web Server (IIS)
Mass Nerder's user avatar
  • 1,027
4 votes

Is it possible to filter out (remove) a single Event ID from the Event Viewer?

By now (checked on Windows Server 2019) this is easily done by prefixing the ID with a minus sign (e.g to exclude 1000 you would type -1000 in the event ID field)
gilad905's user avatar
  • 469
4 votes

how do i find application name using GUID from error in event viewer on Windows Server 2003?

Open up regedit and search for the key under: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF540FFA-D787-4FDF-82E4-4BD5C1302F23} And the default key should provide you a user friendly name.
sverasch's user avatar
4 votes

Can I disable Windows Event Logging for a certain service?

yes you can...i'm gonna use the WLAN-AutoConfig event id 4001 warning first, double click on the error/warning in event viewer and click on the details tab and write down the guid ({9580D7DD-0379-...
ErickC's user avatar
  • 49
4 votes
Accepted

Move Event Log in Windows 2012

You're doing it wrong. Whatever the problem is, the solution is not to relocate the event logs to a network location. You can copy them to a network location, use event forwarding to forward the ...
HopelessN00b's user avatar
4 votes

2012 R2 print server not showing file names on Event id 307

I have found the solution. There's a local computer policy: Computer configuration >> Administrative Templates >> Printers>> allow job name in event logs Then I restarted the server and voilá!
Black Lion's user avatar
4 votes
Accepted

How to filter windows event log with wildcard?

The XPath selector must begin with *, however you cannot use * to filter fields as Xpath 1.0 has no contains operator. https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-...
Clayton's user avatar
  • 4,573
4 votes
Accepted

Can't Find Failed Authentication in Event Viewer

When a user failed to login on a workstation or a server using domain credentials, this will usually triggers 2 type of events: source device (where user is connected): will usually report ID 4625 ...
Michel de Crevoisier's user avatar
4 votes
Accepted

What time zone does windows event logs show

Windows stores the time stamps for events from the event log in UTC time - regardless of the currently configured time zone of the computer. When viewing the event however, the timestamp is converted ...
Lucky Luke's user avatar
  • 1,654
3 votes

Where are windows 10 defender offline scan logs/results?

Go to C:\Windows\Microsoft Antimalware\Support\ open msssWrapper.log and near at the end it should say Scan completed successfully .
vonjd's user avatar
  • 131
3 votes
Accepted

Event Viewer Filtering does not work - invalid query

Pretty sure your problem is: Data=’0x84e9c0d′ Those quote characters are mismatched and neither of those characters appear to be the single quote character (') that is expected.
HopelessN00b's user avatar
3 votes
Accepted

A ton of Logon/off events in Event Viewer

Judging by the name of the server containing DC, I assume this is a domain controller. Also note that the Logon Type is 3, meaning a network logon. For 4624 and 4634 events with logon type 3: You'll ...
Reaces's user avatar
  • 5,617
3 votes

Is it possible to filter out (remove) a single Event ID from the Event Viewer?

I had a very similar situation where I wanted to filter out an entire source instead of a single event ID. As it turns out, it's pretty easy and it works on anything: event level, event sources, task ...
Erin Stebbins's user avatar
3 votes

how do i find application name using GUID from error in event viewer on Windows Server 2003?

When opening Component Services, as Ryan Ries suggests, You can quickly see the Application IDs of every COM application like this: In the left-hand menu, drill down into Component Services -> My ...
jpaugh's user avatar
  • 231
3 votes
Accepted

Exporting Account Name, Domain & Timestamp from Security Auditing Event Log

The details from the event message body are stored in the event XML. You can convert the event to XML and then extract each of the XML fields. The thing to keep in mind is that you should only query ...
twconnell's user avatar
  • 921
3 votes
Accepted

IP Address Change event id for Windows 10?

You aren't going to get an event for IP/Gateway/Mask without a custom script that generates an event whenever one of these properties change. But you can find events for when the IP is changed via ...
twconnell's user avatar
  • 921
2 votes

View Shutdown Event Tracker logs under Windows Server 2008 R2

Slightly cleaner Powershell one-liner that I use to filter out shutdown related EventIDs: Get-EventLog system |?{$_.EventID -in 6008,41,1074,1001}| ft -w To restrict that to just the most useful ...
Amit Naidu's user avatar
2 votes

shortcut for Eventvwr > Connect to another computer

In Windows Versions greater than XP you can still use eventviewer.msc. But the event viewer snap-in only accepts the colon and not the equal sign. mmc eventvwr.msc /computer:hostname
user476862's user avatar
2 votes

Can I disable Windows Event Logging for a certain service?

Use Server Manager, or Perfomance MSC. Under (Performance)->Data Collector Sets->Event Trace Sessions, select EventLog-Application and press [ENTER]. Under Trace Providers tab (default), look at the ...
Ate Somebits's user avatar
2 votes

How to export event viewer errors to Excel in Windows Server 2012

Windows event viewer lets you backup event logs. In Event Viewer – “Save all event as” and you should save them into evtx format. However, it doesn’t allow you to backup an event log from a remote ...
VinWatt's user avatar
  • 21
2 votes
Accepted

How does one add multiple computer names to a custom view in event viewer?

The custom view will only show events that are in the event viewer, you can't filter to show remote computer events unless you have connected to the remote computer (Right Click on 'Event Viewer' ...
Tim Aitken's user avatar
2 votes

How to log the events about the client boot from any live disks in windows server?

This is not possible. Before the computer is booted, there is no software running that has the capability to send data to a log server. You would need a custom BIOS for that. Your best bet is to ...
mzhaase's user avatar
  • 3,848
2 votes

Can I use Windows Event Viewer to get very fine-grained access control failures?

Is it possible to have Event Viewer spit out every failed access control check an application makes? The event log doesn't generate the events that get logged. You need to enable audit logging for ...
joeqwerty's user avatar
  • 111k

Only top scored, non community-wiki answers of a minimum length are eligible