2

Domain Controller OS - Window Server 2008 R2

Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note the Red Rectangle Colour Box. Failure Reason: %%2313 "

enter image description here

But the same log if i check from Event Viewer ( Second Print-Screen Attached - EventViewer.png ) the same Event ID, here it Clearly shows the "Failure Reason: Unknown user name or bad Password"

enter image description here

Why with Powershell the same event id shows Failure reason with some syntax and in Event Viewer log of windows, it display correct?

3
  • 1
    We typically call events like these "bugs". – Michael Hampton Feb 16 '13 at 8:18
  • 1
    Thanks Micheal Hampton for your comment.So,how should i correct this problem? Because with the help of Powershell i get mail for the event id and in mail we are unable to know the real reason. – Param Feb 16 '13 at 8:56
  • connect.microsoft.com – Michael Hampton Feb 16 '13 at 9:20
2

On Windows Vista and later you should use Get-WinEvent as it can read the extended event data more of the time

For more detail about this command you can use -? symbol. or Refer to this article http://technet.microsoft.com/en-us/library/hh849682.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.