Questions tagged [eventviewer]
This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.
205
questions
1
vote
0
answers
91
views
What is the overhead if IIS logs is enabled for Windows event viewer?
We have an .aspx Asp.Net Web Forms C# application on IIS 10 on Windows Server 2022.
Recently an issue occurred where the application pool assigned to the application stopped without a trace to ...
- 125
0
votes
0
answers
38
views
Unreadable Outlook Log Files
For a few weeks now we have two users who need to login into a "domain-login"-window upon starting outlook. We suspect our crm or ad fs to be responsible but can't know for sure. Therefore I'...
- 1
0
votes
1
answer
122
views
Configure what gets logged in event viewer
My server generates around 2.5GB of logs everyday and i just cant store it, upon some investigation i discovered that of my 854,608 logs 394,880 of them looks like this:
The Windows Filtering ...
- 1
0
votes
0
answers
179
views
How to reduce Service Control Manager audit logging "Audit Success"
Maybe this is a niche complaint but it's bloody annoying to have Event Viewer show hundreds of Service Control Manager log entries telling me everything is fine, like:
The Device Setup Manager ...
- 61
0
votes
1
answer
165
views
What event IDs correspond to changes in Windows Add or Remove Programs dialog?
What event does Windows log when a component is registered with Windows "Add or Remove Programs" or more recently "App & features" dialog?
While events with ID 11707 represent ...
- 141
0
votes
1
answer
116
views
Windows Event Collector (WEF) Event Viewer unresponsive
We are using Windows Event Collector (WEF) to forward defined security events to a special server. After some days of using this solution, navigating to "Subscription" within the Event ...
- 99
0
votes
1
answer
213
views
Prevent specific application information event IDs from Source Security-SPP flooding the Windows Application Event Viewer Log
Is there a way to prevent event IDs: 1003 and 1033 from Source: Security-SPP with Level: Information from flooding a Windows server Application Event Viewer Log?
I am seeing approx 4500 of these ...
- 35
0
votes
0
answers
905
views
Windows Server 2012 "User Logoff Notification for Customer Experience Improvement Program" events causing problems with backups
On this Windows Server 2012 server every time a backup fails, there is an event in event viewer (Windows Logs > System) at the very same second the backup file stops been written to.
"User ...
- 115
0
votes
1
answer
1k
views
I am continuously getting Audit Failure on the computer. Does that mean someone is trying to brute force to the computer?
I am getting lots of Audit Failure errors on Windows Logs/Security in event viewer.
See the image below.
Does that mean someone is trying to brute-force to my computer?
0
votes
0
answers
786
views
Windows event log shows events in the future
One of my Windows server VMs seems to be time travelling without my permission:
Screenshot of Windows Event Viewer
The text reads:
time service was not able to sync the system time since 1601267 ...
- 1
0
votes
1
answer
2k
views
Hourly fatal windows alert
On one of my windows server 2012 R2 (going to upgrade), my event logger has been filled with
Event ID 36887 A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert ...
- 163
0
votes
0
answers
527
views
Windows audit "Removable Storage" not generating an event for file deletion
I have a Windows 10 system on which I have enabled removable storage audits (via GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy ...
- 23
1
vote
2
answers
321
views
(Windows) how to launch event viewer GUI console when dealing with huge log files?
i'm having problems working with the event viewer console in windows.
windows version is Windows Server 2019.
the purpose of this server is providing windows event logs gathering from the information ...
- 29
3
votes
2
answers
2k
views
Why are logon types on Domain Controller and Workstation different
When I logon to a specific machine in an Active Directory domain, the logon type recorded in Event Viewer is 10, but the same event log on the domain controller is 3. Why are the all of logon on the ...
1
vote
1
answer
3k
views
Monitoring Event ID 4660 and ID 4663 on Windows 2016 Datacenter
I want to monitor the deletion of files and folders on a Windows 2016 Datacenter Server.
I'm already monitoring event ID 4663 and event ID 4659, which have the following description:
4659: "A ...
- 13
1
vote
0
answers
2k
views
Server 2019 - Very large number of logon events per second even when not network connected?
I have a domain controller installed in my home office, 1 domain controller, 1 PC, 1 user.
I'm running Microsoft Server 2019.
When I look in the Security Event log, I see thousands of Logon (Event ID ...
- 127
0
votes
1
answer
2k
views
What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?
I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
- 3
5
votes
1
answer
21k
views
An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}
I'm getting the following error message in Azure Windows 10 Application Event log periodically:
An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {...
- 292
-1
votes
1
answer
848
views
MSExchange Mid-Tier Storage Event:3019 on Exchange 2013
I am having the Event 3019 on Exchange 2013 with Source "MSExchange Mid-Tier Storage" and have not been able to find any reference on the net for this.
No other failures are reported. The ...
- 300
1
vote
2
answers
293
views
How can I hide the "Actions" panel / tab / pane in Windows "Event Viewer"? [closed]
I want to get rid of the "Actions" panel in the Event Viewer. It doesn't help me. I've made it as small as possible but I just want to hide it.
- 143
0
votes
1
answer
2k
views
why chrome.exe and svchost.exe connecting to RDP port 3389 on 127.0.0.1
i noticed in the event viewer that chrome.exe and svchost.exe are connecting to 127.0.0.1 remotely using RDP port 3389 on multiple Pc's . i couldn't figure out why this event happens even though that ...
0
votes
1
answer
2k
views
Event 4771 (Bad Password Logon) Does not show proper client
We are having issues with frequently locked out accounts.
We are having 4771 {Bad Password} events on our main DC.
Issue: Within the event, the client machine is not properly shown. Instead another DC ...
- 123
1
vote
0
answers
638
views
Scanning all Windows event log folders for an event in a given time interval
When investigating a problem on a Windows client, I regularly find myself looking for relevant event log entries in a pretty well defined timeframe, but with no idea which of the myriad of folders in ...
- 4,246
2
votes
1
answer
1k
views
RDP connection has the source IP of the host server
I came across an event on one of my windows servers,
Machine ABC has a successful incoming RDP connection from 192.168.0.16,
But the IP of machine ABC is 192.168.0.16.
Is it even possible that a ...
- 31
1
vote
1
answer
1k
views
Windows Event Forwarding via https without Windows domain - no event 104
Following the suggestion in this answer, I'm trying to set up Windows Event Forwarding by following this Microsoft's guide:
Setting up a source initiated subscription where the event sources are not ...
- 113
1
vote
1
answer
3k
views
Using Event Filter in Task Scheduler looking for specific keywords
I hope you can help, sometimes a backup task will fail, usually a transient VSS error, and re-running the backup will normally complete successfully. What I am trying to do is use the event filter ...
- 13
0
votes
0
answers
696
views
Windows Server 2019 - Audit which human-user who restart a service
Trying to audit which AD-user who actually restart a service on a particular service.
The service (MyService) is using a serviceaccount to run and get access to different resources.
I want to audit ...
- 21
0
votes
1
answer
2k
views
My windows Task Schdulrer is raising this error "0xE0434352"
I have windows server 2012 R2, and i have some tasks inside Windows Task scheduler which use to work well, but yesterday they start to return this error 0xE0434352, as follow:-
I checked the Event ...
1
vote
0
answers
598
views
Windows Event Filter to Trigger A Scheduled Task Using Custom Data
I need to create a custom event filter to trigger a scheduled task to recover a hung process.
Here is the event log in XML format:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/...
- 476
1
vote
1
answer
44
views
Info about Event logs (Active directory)
Recently 3 of my Active directory admins are unable to login to AD server through RDP.
After we cross checked everything, we found these 3 users are added in one security group called "Deny RDP ...
- 11
0
votes
1
answer
2k
views
Windows System, Application logs vs. "Applications and Services" logs in Event Viewer
Do Error and Warning events from the Microsoft "Applications and Services Logs" get sent to the Windows Application and/or System logs? For example, if AppHost generated an Error event, ...
- 113
0
votes
1
answer
322
views
EVENTID 4648. Mismatch ,Subject (Standard User), CredentialsUsed (Admin), Target(Localhost)
In the Event ID 4648, The subject's Account Name is the "Standard user". But under the credentials used section, the account name is of the "Administrator" and the Target Server is ...
1
vote
0
answers
1k
views
Web management service not start on reboot
Server 2012R2 with management service. Whe reboot the server, the service not start automatically. If i start it manually, it start successfull. There are these events on event viewer:
Service ...
- 11
1
vote
0
answers
149
views
How to get details of the event that triggered a task
A service that we are using writes to the event log when issues occur. I have successfully created a task from the event source and id to run a program that notifies the admins. So far, so good.
...
- 51
2
votes
1
answer
2k
views
What time zone does windows event logs show
I have a doubt on the time zone shown in the windows event logs. I had read that if I export the windows event logs from another machine and open it in my machine which has a different time zone, the ...
- 187
2
votes
0
answers
3k
views
Windows not collecting logs. Error: The WinRM service is not listening for WS-Management requests
I am getting this error
The WinRM service is not listening for WS-Management requests.
User Action
If you did not intentionally stop the service, use the following command to see the WinRM ...
- 121
1
vote
0
answers
2k
views
Prevent Anonymous logons on windows-server 2016
I can't figure out how to entirely disable anonymous logon on Windows Server 2016 which is not a domain controller (regular instance). With the settings currently set I'm truly surprised to see such ...
- 131
0
votes
1
answer
433
views
How to filter Event Viewer for a single website?
I am trying to find out each concurrences for an error happening on a website I managed to create an XML query to filter by EventID
<QueryList>
<Query Id="0" Path="Application">
<...
- 123
2
votes
1
answer
20k
views
IP Address Change event id for Windows 10?
Is there an event id / log / log source for when an ip, gateway, netmask changes in Windows 10?
- 4,969
0
votes
2
answers
93
views
Can I use Windows Event Viewer to get very fine-grained access control failures?
I am a developer on a browser (Firefox) and I am working with Restricted Tokens to lock down our sandbox further than it is currently. I am removing a SID from our content process, and it breaks ...
- 3,317
0
votes
0
answers
191
views
Win32_NTLogEvent query rendering data with 1 hour latency with event viewer
Trying to collect the event log data with WMI query using class Win32_NTLogEvent.But this is not sync with event viewer data.The WMI query rendering data with 1 hour latency with event viewer.Hence ...
1
vote
1
answer
7k
views
Can't Find Failed Authentication in Event Viewer
I'm trying to gather failed login/authentication events from DC's on a 2016 Domain.
I can see 4625 Audit Failure events in the Security Logs on the Domain Controllers when a user fails to login at ...
- 13
1
vote
0
answers
325
views
EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?
I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On ...
- 11
1
vote
0
answers
1k
views
Outlook on Terminalserver loses connection. Event ID 26
Problem Symptoms:
Users experience daily disconnects and reconnects in Outlook running on a Terminal Server and have to log in again. They can not log in instantly but have to wait for approx. 1 ...
- 11
-1
votes
1
answer
6k
views
EventViewer Error "local computer may not have the necessary registry"
I am trying to review event viewer logs that was archived from another Server.
When accessed, the events are listed properly, but details of each event give the following error:
The description ...
- 19
1
vote
1
answer
3k
views
Exporting Account Name, Domain & Timestamp from Security Auditing Event Log
I am currently exporting the last 7 days of Security microsoft windows security auditing logs via powershell to csv.
It works, but with way to much detail, and also, not properly formatted. For ...
- 113
2
votes
2
answers
4k
views
Is it possible to view events from all event logs (including "Applications and Services Logs") simultaneously?
One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-...
- 2,309
1
vote
1
answer
325
views
How to connect from command line to another computer with Event Viewer as another user?
I am trying to connect to another computer with Event Viewer from command line. And it can be done.
However, I need to connect as another user (not my logged in user). Is there a way to do that?
- 2,897
1
vote
1
answer
5k
views
Grant access to Event Viewer "Application and Services Logs" via GPO
My monitoring team has requested to be able to read the logs under "Application and Services" in 2008/2012/2016 event viewer. These are the logs that reside in "%SystemRoot%\System32\Winevt\Logs\". ...
7
votes
3
answers
60k
views
Windows event codes for startup/shutdown lock/unlock
I'm trying to build up a list of event Ids that can be used to determine when the machine has been shutdown, started up, locked and unlocked. So far, I've found 6 event IDs which seem to be best ...
- 181