47
votes
Accepted
Find out who disabled a Windows service
When the start type of a service is changed, an event is recorded in the system event log , with id 7040 and source Service Control Manager.
The user that performed the operation is displayed in the ...
14
votes
Find out who disabled a Windows service
In Event Viewer, look in the "Windows Logs"->"System" event log, and filter for Source "Service Control Manager" and Event ID 7040. Find the event saying "The start type of the service was changed ...
13
votes
Where are windows 10 defender offline scan logs/results?
Windows Defender adds entries to the Event Viewer in the following location:
Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> Windows Defender >> Operational
Where you'll ...
12
votes
How to filter windows event log with wildcard?
Use Powershell
Get-EventLog -LogName "System" | ?{$_.Message -like "*YourSearchString*"} | Out-GridView
11
votes
Where are windows 10 defender offline scan logs/results?
According to Microsoft, any threats detected by the offline scanner will show up in the Threat History (where the online scanner also records any viruses found):
Where can I find scan results?
...
11
votes
Accepted
Windows event codes for startup/shutdown lock/unlock
Refering to your request about starting and shutdown event IDs, I made the list below based on a Windows 10 machine. The main point is that depending on the shutdown action (planned reboot, planned ...
10
votes
How to enable Audit Failure logs in Active Directory?
Note that in Win2008 server and above, you need to use the "Advanced Audit Policy Configuration" options in the GPO. See screenshot:
6
votes
Where in the event log is the IIS AppPool recycling events being recorded?
Event viewer / Custom views / Server Roles / Web Server (IIS)
4
votes
Is it possible to filter out (remove) a single Event ID from the Event Viewer?
By now (checked on Windows Server 2019) this is easily done by prefixing the ID with a minus sign (e.g to exclude 1000 you would type -1000 in the event ID field)
4
votes
how do i find application name using GUID from error in event viewer on Windows Server 2003?
Open up regedit and search for the key under:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF540FFA-D787-4FDF-82E4-4BD5C1302F23}
And the default key should provide you a user friendly name.
4
votes
Can I disable Windows Event Logging for a certain service?
yes you can...i'm gonna use the WLAN-AutoConfig event id 4001 warning
first, double click on the error/warning in event viewer and click on the details tab and write down the guid ({9580D7DD-0379-...
4
votes
Accepted
Move Event Log in Windows 2012
You're doing it wrong. Whatever the problem is, the solution is not to relocate the event logs to a network location. You can copy them to a network location, use event forwarding to forward the ...
4
votes
2012 R2 print server not showing file names on Event id 307
I have found the solution. There's a local computer policy: Computer configuration >> Administrative Templates >> Printers>> allow job name in event logs
Then I restarted the server and voilá!
4
votes
Accepted
How to filter windows event log with wildcard?
The XPath selector must begin with *, however you cannot use * to filter fields as Xpath 1.0 has no contains operator.
https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-...
4
votes
Accepted
Can't Find Failed Authentication in Event Viewer
When a user failed to login on a workstation or a server using domain credentials, this will usually triggers 2 type of events:
source device (where user is connected): will usually report ID 4625 ...
4
votes
Accepted
What time zone does windows event logs show
Windows stores the time stamps for events from the event log in UTC time - regardless of the currently configured time zone of the computer. When viewing the event however, the timestamp is converted ...
3
votes
Where are windows 10 defender offline scan logs/results?
Go to C:\Windows\Microsoft Antimalware\Support\ open msssWrapper.log and near at the end it should say
Scan completed successfully
.
3
votes
Accepted
Event Viewer Filtering does not work - invalid query
Pretty sure your problem is:
Data=’0x84e9c0d′
Those quote characters are mismatched and neither of those characters appear to be the single quote character (') that is expected.
3
votes
Accepted
A ton of Logon/off events in Event Viewer
Judging by the name of the server containing DC, I assume this is a domain controller.
Also note that the Logon Type is 3, meaning a network logon.
For 4624 and 4634 events with logon type 3:
You'll ...
3
votes
Is it possible to filter out (remove) a single Event ID from the Event Viewer?
I had a very similar situation where I wanted to filter out an entire source instead of a single event ID. As it turns out, it's pretty easy and it works on anything: event level, event sources, task ...
3
votes
how do i find application name using GUID from error in event viewer on Windows Server 2003?
When opening Component Services, as Ryan Ries suggests, You can quickly see the Application IDs of every COM application like this:
In the left-hand menu, drill down into Component Services -> My ...
3
votes
Accepted
Exporting Account Name, Domain & Timestamp from Security Auditing Event Log
The details from the event message body are stored in the event XML. You can convert the event to XML and then extract each of the XML fields. The thing to keep in mind is that you should only query ...
3
votes
Accepted
IP Address Change event id for Windows 10?
You aren't going to get an event for IP/Gateway/Mask without a custom script that generates an event whenever one of these properties change. But you can find events for when the IP is changed via ...
2
votes
View Shutdown Event Tracker logs under Windows Server 2008 R2
Slightly cleaner Powershell one-liner that I use to filter out shutdown related EventIDs:
Get-EventLog system |?{$_.EventID -in 6008,41,1074,1001}| ft -w
To restrict that to just the most useful ...
2
votes
shortcut for Eventvwr > Connect to another computer
In Windows Versions greater than XP you can still use eventviewer.msc.
But the event viewer snap-in only accepts the colon and not the equal sign.
mmc eventvwr.msc /computer:hostname
2
votes
Can I disable Windows Event Logging for a certain service?
Use Server Manager, or Perfomance MSC.
Under (Performance)->Data Collector Sets->Event Trace Sessions, select EventLog-Application and press [ENTER].
Under Trace Providers tab (default), look at the ...
2
votes
How to export event viewer errors to Excel in Windows Server 2012
Windows event viewer lets you backup event logs. In Event Viewer – “Save all event as” and you should save them into evtx format. However, it doesn’t allow you to backup an event log from a remote ...
2
votes
Accepted
How does one add multiple computer names to a custom view in event viewer?
The custom view will only show events that are in the event viewer, you can't filter to show remote computer events unless you have connected to the remote computer (Right Click on 'Event Viewer' ...
2
votes
How to log the events about the client boot from any live disks in windows server?
This is not possible.
Before the computer is booted, there is no software running that has the capability to send data to a log server. You would need a custom BIOS for that.
Your best bet is to ...
2
votes
Can I use Windows Event Viewer to get very fine-grained access control failures?
Is it possible to have Event Viewer spit out every failed access
control check an application makes?
The event log doesn't generate the events that get logged. You need to enable audit logging for ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
eventviewer × 202windows-event-log × 105
windows × 64
windows-server-2008 × 28
windows-server-2008-r2 × 28
windows-server-2012-r2 × 20
windows-server-2003 × 19
active-directory × 14
audit × 12
security × 9
powershell × 9
group-policy × 9
windows-server-2012 × 8
login × 6
windows-server-2019 × 5
task-scheduler × 5
winrm × 5
iis × 4
domain-controller × 4
rdp × 4
xml × 4
windows-7 × 3
windows-server-2016 × 3
asp.net × 3
service × 3