666 reputation
36
bio website eventlogblog.com
location Evanston, IL
age 39
visits member for 3 years, 5 months
seen Oct 17 at 15:01

Oct
7
comment Program does not run properly as Scheduled Task
OK. Have you tried running it under the LocalSystem account? Also, have you tried monitoring the process launch event with Process Monitor from Sysinternals?
Oct
7
comment Program does not run properly as Scheduled Task
Not sure if I missed this, but under which user account are you launching the task? Are you launching it under the SYSTEM account, or an actual user? Is it a local user or a domain user? Does the app interact with the network?
Sep
22
comment What time zone are the description timestamps in Windows Event log (UTC?)
The description of the event you posted in your question does not contain a time stamp. Anything in the description would be hard-coded (and embedded with the event), since that is created by the software which logs the event. Only the software which logs the event could change that to be UTC.
May
16
awarded  Yearling
Apr
29
comment Write to Windows Event Log when an IIS site is started or stopped
I'll see if I can adapt the script to monitor sites on 2008 as well. Also, please don't forget to upvote useful answers.
Apr
29
answered Write to Windows Event Log when an IIS site is started or stopped
Apr
3
answered Tracking memory problems
Feb
6
comment Filtering Security Logs by User and Logon Type
Interesting. Which exact setting did you end up turning on? What's a bit strange is that you were seeing other logon events, yet not the console logons. I was under the impression that they are all configured with the same setting.
Feb
5
comment Filtering Security Logs by User and Logon Type
Have you verified your audit settings in the local security policy (or domain policy if it's part of a domain) to ensure that all logons are being audited? Let me know if you need more info.
Feb
4
comment Filtering Security Logs by User and Logon Type
It looks like your query is working if you are getting results with other logon types. It's possible that you need to look at other logon types, in particular logon type 11 which is often used instead of logon type 2 on Vista and later. You can see all the logon types here: myeventlog.com/search/show/799. I bet your logons are of type 11. Let me know.
Feb
4
answered Filtering Security Logs by User and Logon Type
Nov
15
answered Windows Services: How to schedule and monitor them?
Nov
8
comment How to record IIS 8 client authentication errors in Windows Events?
One alternative to running a script would be to use a real-time log file monitoring solution to log contents from a log file (e.g. IIS log) to the event log. We develop EventSentry (eventsentry.com), and the free edition EventSentry Light does exactly that. You just configure to look for certain text patterns (e.g. 403.7), and when found it logs the entire line of the log file to the event log.
Sep
25
answered Which events in the events log should be turned into notifications for windows servers?
Jun
25
comment How Do I Change the Active DIrectory Auditing Events Maximum?
I'd be curious under which event id & source this event was logged?
May
22
comment What's this odd logon failure I see every day?
Have you checked your scheduled tasks yet? Logon type 4 is a batch logon, and most likely coming from a scheduled task (the fact it happens at the same time would also indicate that it's some sort of job). Can you post the complete event here, such as event id and any other relevant information?
May
21
answered Remote disk monitoring with WMI without admin rights
May
21
comment Remote disk monitoring with WMI without admin rights
Glad I could help, will do that now.
May
16
awarded  Yearling
May
14
comment Remote disk monitoring with WMI without admin rights
Have you checked the ACL on the root of the drive?