Questions tagged [eventviewer]

This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
62 views

Scanning all Windows event log folders for an event in a given time interval

When investigating a problem on a Windows client, I regularly find myself looking for relevant event log entries in a pretty well defined timeframe, but with no idea which of the myriad of folders in ...
1
vote
1answer
54 views

RDP connection has the source IP of the host server

I came across an event on one of my windows servers, Machine ABC has a successful incoming RDP connection from 192.168.0.16, But the IP of machine ABC is 192.168.0.16. Is it even possible that a ...
1
vote
1answer
174 views

Windows Event Forwarding via https without Windows domain - no event 104

Following the suggestion in this answer, I'm trying to set up Windows Event Forwarding by following this Microsoft's guide: Setting up a source initiated subscription where the event sources are not ...
1
vote
1answer
62 views

Using Event Filter in Task Scheduler looking for specific keywords

I hope you can help, sometimes a backup task will fail, usually a transient VSS error, and re-running the backup will normally complete successfully. What I am trying to do is use the event filter ...
0
votes
0answers
75 views

Windows Server 2019 - Audit which human-user who restart a service

Trying to audit which AD-user who actually restart a service on a particular service. The service (MyService) is using a serviceaccount to run and get access to different resources. I want to audit ...
0
votes
0answers
833 views

My windows Task Schdulrer is raising this error “0xE0434352”

I have windows server 2012 R2, and i have some tasks inside Windows Task scheduler which use to work well, but yesterday they start to return this error 0xE0434352, as follow:- I checked the Event ...
1
vote
0answers
114 views

Windows Event Filter to Trigger A Scheduled Task Using Custom Data

I need to create a custom event filter to trigger a scheduled task to recover a hung process. Here is the event log in XML format: <Event xmlns="http://schemas.microsoft.com/win/2004/08/...
0
votes
0answers
442 views

Event 1006: SMBServer, The share denied access to the client

I have faced to Event: " The share denied access to the client. Client Name: \172.17.72.2 Client Address: 172.17.72.2:39725 User Name: SMBMM\ars Session ID: 0x980038000045 Share Name: \*\in Share ...
1
vote
1answer
27 views

Info about Event logs (Active directory)

Recently 3 of my Active directory admins are unable to login to AD server through RDP. After we cross checked everything, we found these 3 users are added in one security group called "Deny RDP ...
-1
votes
1answer
472 views

Windows System, Application logs vs. “Applications and Services” logs in Event Viewer

Do Error and Warning events from the Microsoft "Applications and Services Logs" get sent to the Windows Application and/or System logs? For example, if AppHost generated an Error event, ...
0
votes
1answer
52 views

EVENTID 4648. Mismatch ,Subject (Standard User), CredentialsUsed (Admin), Target(Localhost)

In the Event ID 4648, The subject's Account Name is the "Standard user". But under the credentials used section, the account name is of the "Administrator" and the Target Server is ...
1
vote
0answers
323 views

Web management service not start on reboot

Server 2012R2 with management service. Whe reboot the server, the service not start automatically. If i start it manually, it start successfull. There are these events on event viewer: Service ...
1
vote
0answers
31 views

How to get details of the event that triggered a task

A service that we are using writes to the event log when issues occur. I have successfully created a task from the event source and id to run a program that notifies the admins. So far, so good. ...
2
votes
1answer
295 views

What time zone does windows event logs show

I have a doubt on the time zone shown in the windows event logs. I had read that if I export the windows event logs from another machine and open it in my machine which has a different time zone, the ...
2
votes
0answers
2k views

Windows not collecting logs. Error: The WinRM service is not listening for WS-Management requests

I am getting this error The WinRM service is not listening for WS-Management requests. User Action If you did not intentionally stop the service, use the following command to see the WinRM ...
1
vote
0answers
1k views

Prevent Anonymous logons on windows-server 2016

I can't figure out how to entirely disable anonymous logon on Windows Server 2016 which is not a domain controller (regular instance). With the settings currently set I'm truly surprised to see such ...
0
votes
1answer
90 views

How to filter Event Viewer for a single website?

I am trying to find out each concurrences for an error happening on a website I managed to create an XML query to filter by EventID <QueryList> <Query Id="0" Path="Application"> <...
2
votes
1answer
5k views

IP Address Change event id for Windows 10?

Is there an event id / log / log source for when an ip, gateway, netmask changes in Windows 10?
0
votes
2answers
30 views

Can I use Windows Event Viewer to get very fine-grained access control failures?

I am a developer on a browser (Firefox) and I am working with Restricted Tokens to lock down our sandbox further than it is currently. I am removing a SID from our content process, and it breaks ...
0
votes
0answers
100 views

Win32_NTLogEvent query rendering data with 1 hour latency with event viewer

Trying to collect the event log data with WMI query using class Win32_NTLogEvent.But this is not sync with event viewer data.The WMI query rendering data with 1 hour latency with event viewer.Hence ...
1
vote
1answer
2k views

Can't Find Failed Authentication in Event Viewer

I'm trying to gather failed login/authentication events from DC's on a 2016 Domain. I can see 4625 Audit Failure events in the Security Logs on the Domain Controllers when a user fails to login at ...
1
vote
0answers
225 views

EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?

I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On ...
1
vote
0answers
669 views

Outlook on Terminalserver loses connection. Event ID 26

Problem Symptoms: Users experience daily disconnects and reconnects in Outlook running on a Terminal Server and have to log in again. They can not log in instantly but have to wait for approx. 1 ...
0
votes
1answer
2k views

EventViewer Error “local computer may not have the necessary registry”

I am trying to review event viewer logs that was archived from another Server. When accessed, the events are listed properly, but details of each event give the following error: The description ...
1
vote
1answer
2k views

Exporting Account Name, Domain & Timestamp from Security Auditing Event Log

I am currently exporting the last 7 days of Security microsoft windows security auditing logs via powershell to csv. It works, but with way to much detail, and also, not properly formatted. For ...
1
vote
2answers
2k views

Is it possible to view events from all event logs (including “Applications and Services Logs”) simultaneously?

One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-...
1
vote
1answer
113 views

How to connect from command line to another computer with Event Viewer as another user?

I am trying to connect to another computer with Event Viewer from command line. And it can be done. However, I need to connect as another user (not my logged in user). Is there a way to do that?
1
vote
1answer
3k views

Grant access to Event Viewer “Application and Services Logs” via GPO

My monitoring team has requested to be able to read the logs under "Application and Services" in 2008/2012/2016 event viewer. These are the logs that reside in "%SystemRoot%\System32\Winevt\Logs\". ...
4
votes
1answer
26k views

Windows event codes for startup/shutdown lock/unlock

I'm trying to build up a list of event Ids that can be used to determine when the machine has been shutdown, started up, locked and unlocked. So far, I've found 6 event IDs which seem to be best ...
1
vote
0answers
3k views

What is RDSAppXPlugin?

In windows 2012 event viewer in the "Applications and Services > Microsoft > Windows > TerminalSerices - LocalSessionManager > Operational" path I can see the following event: "Plugin RDSAppXPlugin ...
1
vote
2answers
77 views

Adding an eventlog to an existing Windows Log

I have the following Event Log: This Event Log only appears inside Custom Views -> Server Roles -> Remote Desktop Services. What I'd like to do is add it to Windows Logs -> Security as I already have ...
0
votes
1answer
447 views

Account Lockout not showing up in Event Viewer

I wrote a powershell script to send me an email for Account Lockout events when I noticed there were almost none in the Event Viewer. I used a test user and attempted five bad logins, and got the ...
0
votes
1answer
3k views

Windows Server 2012 R2 - Help finding failed logon attempts source

I'm seeking help for this issue that I'm having in our AD domain controller where a lot of security events are being logged due to failed logon attempts by a (former) domain user that has been ...
1
vote
1answer
35 views

Local PC Event Viewer not logging account creation/deletion

I have a GPO that is setting audit account management success/failure on a windows 7 workstation. RSOP User Acc is created Any idea what could be causing this issue with logging events?
30
votes
2answers
45k views

Find out who disabled a Windows service

I was doing some fault finding, and I've discovered two services which should be set to automatic have been set to disabled. What is the best way to find out who did this? It could be someone from ...
0
votes
1answer
103 views

WS 2008 R2 get process by id

I have received the following message in the event viewer: A worker process with process id of '10088' serving application pool 'mypoolapp' has requested a recycle because the worker process ...
1
vote
1answer
71 views

How to log the events about the client boot from any live disks in windows server?

Are there any ways to find out whether any clients boot from a live disk for example Active Boot Disk? How to log that into windows server events log? Thanks in advanced. Server: Windows Server ...
0
votes
1answer
403 views

Audit Logon Events not turned on but still generates 4624 events

Why would a Windows Server still generates 4624 events (An account was successfully logged on) in the Security log even though the Audit Policy's Audit logon events value is set to No auditing.
1
vote
3answers
1k views

WEF collect Windows Defender logs from clients on Windows Server 2012 R2

I'm trying to set up Windows Event Forwarding on a Windows 2012 R2 collector server. I was looking to collect events from Windows Defender, which comes by default on Windows 7 and 8 clients. I know ...
1
vote
0answers
903 views

Windows 2012 RDS Server logon causes Audit Failure 4625

We have a Windows 2012 R2 RDS server and a Windows 2008 R2 Domain Controller. Every time a user logs on or off of the RDS server, It logs event 4771 audit failure incorrect username or password for ...
0
votes
0answers
53 views

How to find reason behind changed state of virtual machines?

I am working in Windows Virtual machines which were part of Hyper-V setup. It was in running state but now I see it state as "OFF", I have manually changed the state to "Running" but I want to know ...
1
vote
1answer
593 views

Did anyone get their Tandberg RDXmon service installed incorrectly or is it meant to be that way?

We have several "RDX" USB cartridge drives on customers' sites. Normally they don't log anything to the Windows event logs. This changes after you install the optional "RDX Tools". ...
10
votes
2answers
19k views

How to filter windows event log with wildcard?

According to the document here, the asterisk wildcard is supported and hence it should work in eg. *[EventData[Data[@Name='TargetUserName'] ='User1*']] but I cannot get any wildcard filter to work - ...
-1
votes
2answers
1k views

Group Policy to enable file audit

What am I missing here? I'm trying to enable file auditing so I can see who deleted a file via security logs in event viewer. I created the below group policy Computer Configuration > Windows ...
-1
votes
1answer
2k views

Hard disk failure or about to fail Intel RST software RAID-1 volume event log

If any one of the two Hardisk of Intel rapid Storage Technology(IRST) Software RAID-1 is about to fail or already failed, then what event will write in event viewer log and what is the Event ID for ...
12
votes
4answers
60k views

Where are windows 10 defender offline scan logs/results?

I can't find any events or log files, are there such records somewhere or WD reports only if it finds something? Windows 10 pro, drive is encrypted with bitlocker (might affects somehow?)
0
votes
1answer
3k views

Event log forwarding: source initiated not working for desktops

I have successfully set up 2 subscriptions for collector initiated and they are fowarding events. Now I am attempting to add a 3rd subscription to get the logs for all my desktops, so due to the ...
3
votes
1answer
14k views

A ton of Logon/off events in Event Viewer

I am running a Win2012 server in VMware, I have installed IIS, NAP, VPN, DHCP, DNS, WDS, AD DS, AD CS. I have win7 clients in my domain, but they're not turned on. The problem is, I am getting a ...
1
vote
1answer
3k views

Windows Domain accounts gets locked without any failed logon events

I have a domain account which keeps getting locked without any prior wrong password login attempts: I.e (completely stripped off the details, just to give you an idea) 10:15:49 - logon successful 10:...
-1
votes
1answer
3k views

Move Event Log in Windows 2012

Ultimately I'm trying to have security logs written to a remote storage, \\Server-Name\Drive-Letter\File_Name.evtx For testing I'm trying to move the default log path from %SystemRoot%\System32\...