Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [eventviewer]

This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

0
votes
0answers
6 views

How to get multiple path in wevtutil?

In Event Viewer I have this Custom View: <QueryList> <Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"> <Select Path="Microsoft-Windows-...
0
votes
0answers
7 views

Server Run time log to X minute precision

I have a situation where I'd rather not code/script a process that would be run every few clock cycles, seconds, or minutes - but I need a level of precision on keeping track of when a server is on. ...
1
vote
0answers
101 views

EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?

I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On ...
1
vote
0answers
337 views

Outlook on Terminalserver loses connection. Event ID 26

Problem Symptoms: Users experience daily disconnects and reconnects in Outlook running on a Terminal Server and have to log in again. They can not log in instantly but have to wait for approx. 1 ...
0
votes
0answers
454 views

Windows Event Forwarding (Collector Initiated Subscription) returns error code (0x32)

I've been struggling within the past few days to get the WEF working without luck. I have tried different things which I could harvest through Google, but none helped! Here is a insight to the ...
0
votes
0answers
171 views

Description for Event ID 110 cannot be found

I am trying to work with an old (VB6) program that runs as a Windows service. When I run it, I'm getting the following error in Event Viewer. The description for Event ID 110 from source Ascend ...
0
votes
1answer
313 views

EventViewer Error “local computer may not have the necessary registry”

I am trying to review event viewer logs that was archived from another Server. When accessed, the events are listed properly, but details of each event give the following error: The description ...
1
vote
1answer
474 views

Exporting Account Name, Domain & Timestamp from Security Auditing Event Log

I am currently exporting the last 7 days of Security microsoft windows security auditing logs via powershell to csv. It works, but with way to much detail, and also, not properly formatted. For ...
0
votes
1answer
381 views

Is it possible to view events from all event logs (including “Applications and Services Logs”) simultaneously?

One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-...
1
vote
1answer
44 views

How to connect from command line to another computer with Event Viewer as another user?

I am trying to connect to another computer with Event Viewer from command line. And it can be done. However, I need to connect as another user (not my logged in user). Is there a way to do that?
1
vote
1answer
787 views

Grant access to Event Viewer “Application and Services Logs” via GPO

My monitoring team has requested to be able to read the logs under "Application and Services" in 2008/2012/2016 event viewer. These are the logs that reside in "%SystemRoot%\System32\Winevt\Logs\". ...
2
votes
1answer
7k views

Windows event codes for startup/shutdown lock/unlock

I'm trying to build up a list of event Ids that can be used to determine when the machine has been shutdown, started up, locked and unlocked. So far, I've found 6 event IDs which seem to be best ...
1
vote
0answers
2k views

What is RDSAppXPlugin?

In windows 2012 event viewer in the "Applications and Services > Microsoft > Windows > TerminalSerices - LocalSessionManager > Operational" path I can see the following event: "Plugin RDSAppXPlugin ...
1
vote
2answers
42 views

Adding an eventlog to an existing Windows Log

I have the following Event Log: This Event Log only appears inside Custom Views -> Server Roles -> Remote Desktop Services. What I'd like to do is add it to Windows Logs -> Security as I already have ...
0
votes
1answer
96 views

Account Lockout not showing up in Event Viewer

I wrote a powershell script to send me an email for Account Lockout events when I noticed there were almost none in the Event Viewer. I used a test user and attempted five bad logins, and got the ...
0
votes
1answer
819 views

Windows Server 2012 R2 - Help finding failed logon attempts source

I'm seeking help for this issue that I'm having in our AD domain controller where a lot of security events are being logged due to failed logon attempts by a (former) domain user that has been ...
1
vote
1answer
33 views

Local PC Event Viewer not logging account creation/deletion

I have a GPO that is setting audit account management success/failure on a windows 7 workstation. RSOP User Acc is created Any idea what could be causing this issue with logging events?
29
votes
2answers
19k views

Find out who disabled a Windows service

I was doing some fault finding, and I've discovered two services which should be set to automatic have been set to disabled. What is the best way to find out who did this? It could be someone from ...
0
votes
1answer
57 views

WS 2008 R2 get process by id

I have received the following message in the event viewer: A worker process with process id of '10088' serving application pool 'mypoolapp' has requested a recycle because the worker process ...
1
vote
1answer
65 views

How to log the events about the client boot from any live disks in windows server?

Are there any ways to find out whether any clients boot from a live disk for example Active Boot Disk? How to log that into windows server events log? Thanks in advanced. Server: Windows Server ...
0
votes
1answer
240 views

Audit Logon Events not turned on but still generates 4624 events

Why would a Windows Server still generates 4624 events (An account was successfully logged on) in the Security log even though the Audit Policy's Audit logon events value is set to No auditing.
1
vote
3answers
563 views

WEF collect Windows Defender logs from clients on Windows Server 2012 R2

I'm trying to set up Windows Event Forwarding on a Windows 2012 R2 collector server. I was looking to collect events from Windows Defender, which comes by default on Windows 7 and 8 clients. I know ...
1
vote
0answers
476 views

Windows 2012 RDS Server logon causes Audit Failure 4625

We have a Windows 2012 R2 RDS server and a Windows 2008 R2 Domain Controller. Every time a user logs on or off of the RDS server, It logs event 4771 audit failure incorrect username or password for ...
0
votes
0answers
45 views

How to find reason behind changed state of virtual machines?

I am working in Windows Virtual machines which were part of Hyper-V setup. It was in running state but now I see it state as "OFF", I have manually changed the state to "Running" but I want to know ...
1
vote
1answer
313 views

Did anyone get their Tandberg RDXmon service installed incorrectly or is it meant to be that way?

We have several "RDX" USB cartridge drives on customers' sites. Normally they don't log anything to the Windows event logs. This changes after you install the optional "RDX Tools". After the ...
6
votes
2answers
10k views

How to filter windows event log with wildcard?

According to the document here, the asterisk wildcard is supported and hence it should work in eg. *[EventData[Data[@Name='TargetUserName'] ='User1*']] but I cannot get any wildcard filter to work - ...
0
votes
2answers
793 views

Group Policy to enable file audit

What am I missing here? I'm trying to enable file auditing so I can see who deleted a file via security logs in event viewer. I created the below group policy Computer Configuration > Windows ...
-1
votes
1answer
1k views

Hard disk failure or about to fail Intel RST software RAID-1 volume event log

If any one of the two Hardisk of Intel rapid Storage Technology(IRST) Software RAID-1 is about to fail or already failed, then what event will write in event viewer log and what is the Event ID for ...
6
votes
3answers
15k views

Where are windows 10 defender offline scan logs/results?

I can't find any events or log files, are there such records somewhere or WD reports only if it finds something? Windows 10 pro, drive is encrypted with bitlocker (might affects somehow?)
0
votes
1answer
2k views

Event log forwarding: source initiated not working for desktops

I have successfully set up 2 subscriptions for collector initiated and they are fowarding events. Now I am attempting to add a 3rd subscription to get the logs for all my desktops, so due to the ...
2
votes
1answer
6k views

A ton of Logon/off events in Event Viewer

I am running a Win2012 server in VMware, I have installed IIS, NAP, VPN, DHCP, DNS, WDS, AD DS, AD CS. I have win7 clients in my domain, but they're not turned on. The problem is, I am getting a ...
1
vote
1answer
2k views

Windows Domain accounts gets locked without any failed logon events

I have a domain account which keeps getting locked without any prior wrong password login attempts: I.e (completely stripped off the details, just to give you an idea) 10:15:49 - logon successful 10:...
-1
votes
1answer
1k views

Move Event Log in Windows 2012

Ultimately I'm trying to have security logs written to a remote storage, \\Server-Name\Drive-Letter\File_Name.evtx For testing I'm trying to move the default log path from %SystemRoot%\System32\...
1
vote
0answers
322 views

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
1
vote
1answer
37 views

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only ...
1
vote
1answer
1k views

Auditing Log is Full - Eventlog Archive GPO not working

I am trying to create an Archive for Eventlog but it does not seem to work. Server 2k12 R2 Environment. Following is the GPO I have enabled: I have rebooted the server and made sure it is being ...
1
vote
1answer
208 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0answers
280 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
3
votes
1answer
2k views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
1
vote
1answer
1k views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
0
votes
2answers
3k views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
2
votes
1answer
8k views

Event log subscription returns error code (0x138C)

I have been battling getting event log subscriptions to work on my Server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1answer
1k views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
1
vote
2answers
6k views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
1
vote
0answers
1k views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
1
vote
1answer
481 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
0
votes
1answer
301 views

Windows 7 Pro blue screen Event Viewer Event ID 10

I have a user who's Windows 7 Pro machine repeatedly blue screens and the Event Viewer has numerous entries like below that seem to occur about the time of the BSOD occurrences. I would appreciate any ...
0
votes
1answer
34 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
3
votes
1answer
2k views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
-1
votes
1answer
28 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...