Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

1
vote
1answer
44 views

Windows Server 2016 and Windows 10: Cannot set up Windows Event Forwarding via HTTPS

Alright so I've been trying to set up Windows Event Forwarding via HTTPS for a while now and in the process, I've hit my share of errors that I managed to address one by one, but now I've been stuck ...
1
vote
0answers
12 views

How to find out if a specific file was accessed by a process and denied access?

I was recently trying to install an SSL certificate and I was unaware of which account was being used on IIS to access it. I thought that maybe if I looked in the Security log I would find out what ...
2
votes
2answers
63 views

Permissions changes on Windows event log are not working (GPO change)

I'm trying to grant permissions to the Network Service account (SID S-1-5-20) on the event log "Microsoft-Windows-CAPI2/Operational" (see picture below). However I need to push this change on more ...
0
votes
0answers
7 views

Server Run time log to X minute precision

I have a situation where I'd rather not code/script a process that would be run every few clock cycles, seconds, or minutes - but I need a level of precision on keeping track of when a server is on. ...
5
votes
1answer
69 views

Event Descriptions Missing From Get-EventLog but present in Get-WinEvent and Event Viewer

Many of the event descriptions for event log events are missing when I query them in powershell with Get-EventLog but they are present when I query them in powershell with Get-WinEvent or view them in ...
0
votes
0answers
58 views

user account successfully authenticated after multiple Kerberos pre-authentication failed/ account lock out event

We have a user case to detect brute force attack, which refer to successful login after multiple failed logon events. Sometimes the alert triggered when there are multiple account lock out events ...
0
votes
0answers
13 views

Where are the Console Events (CTRL_C_EVENT, CTRL_BREAK_EVENT etc) stored in the Windows Event logs?

Of late I've had to write Console Event Handling into some our C# command-line tools. This has been largely successful. What I'm curious know is this: in which Windows Event log are these events ...
2
votes
0answers
38 views

[WINDOWS]: identifying new protected accounts based on ID 4780

As a security best practice, I would like to keep track in my Windows Active Directory domain of any new "Protected Accounts and Groups". According Microsoft, this concerns any user or group which is ...
0
votes
1answer
18 views

wevtutil without admin permissions

Is it possible to install a provider without admin permissions? whenever I try something like wevtutil im MyManifest.man I got 'Access is denied.'. If I run the same command in an admin command ...
0
votes
1answer
100 views

Session “NT Kernel Logger” failed to start

I have encountered an error on windows server 2012 recently. Session "NT Kernel Logger" failed to start with the following error: 0xc0000022 More Details: LogName: Microsoft-Windows-Kernel-...
0
votes
0answers
51 views

How to read nested event logs with Get-EventLog?

I have a system with a number of nested event logs. OSIsoft likes to nest their logs in folders. These logs can be retrieved using Get-WinEvent, as follows, but not by Get-EventLog. It seems that Get-...
0
votes
2answers
37 views

Is there unique information or other reasons a Windows event 'Message' should not be discarded?

Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system? Is it the case that these are composed of data from other attributes, ...
2
votes
1answer
208 views

filtering event logs with specific TIME range of ANY day

How can I query windows server events between two times of any day? I have tried with PowerShell... Get-EventLog -Logname xxxx -After 04:00:00 -Before 04:00:30 ...but just returns today's events
2
votes
1answer
118 views

system center operation management ( SCOM ) log collection and full text searching

I want to collect all events in all windows servers (nearly 50 server) (from windows event viewer) in SCOM, and full text search on it. My question is: how can I do it?
1
vote
1answer
62 views

Filter Windows Event Security logs by a range of Source IP Address

So i know you could filter by a Source IP Address. But what if you want to filter by a range of Source IP address. i tried <QueryList> <Query Id="0" Path="Security"> <Select ...
0
votes
1answer
34 views

Windows - Alert on Event Log failure [closed]

I need to display a local alert when Windows Event Log fails. Other than creating a script that is triggered as part of the service recovery options, is there another way to accomplish this?
0
votes
0answers
907 views

Event log error for Microsoft-Windows-Perflib ID 1008

I started seeing the following error in my Windows Server 2012 event application logs somewhat recently, possibly after installing some Windows updates. Log Name: Application Source: ...
2
votes
1answer
428 views

Windows Backup / wbadmin errors | Source: SPP | Event id: 16389 | Increase SPP CreateTimeout?

After a reboot we encounter while the first backup (wbadmin) on a Windows Server 2016 these errors in the eventlog: Source: SPP Event ID 16389 Details: The writer's timeout expired between the ...
1
vote
2answers
60 views

Windows server 2016 Security Log - Remove extra description text?

Preface once again: I'm a Linux admin. Is there any way to reduce the verbosity of Windows Server Security Log messages? For example, every logon event "4624" has this extra text describing what a ...
1
vote
0answers
141 views

EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?

I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On ...
1
vote
0answers
110 views

Logging of MySQL Queries and Forwarding to Syslog/Event log

I was to able to enable Error log, General Query log, Slow Query Log and Binary Log and was able to forward the logs to Syslog. I have few questions about logging. 1) The error log is automatically ...
3
votes
2answers
143 views

Windows Server File Share Audit File Attribute Modification

My goal is to identify what user has set the Hidden attribute on a file within the local file share. I have enabled File Share access auditing as per this article. In short: Added a group policy ...
3
votes
1answer
349 views

Execute a Windows task triggered by registry changes

I'm looking for a possibility to execute a script in case a particular registry key is going to be created or modified. In the Windows Taks Scheduler there is a way to execute scripts triggered by ...
2
votes
1answer
134 views

Windows 2016 Server Event Date Time is in Future

Current machine date time is Sept 25th 2018 06:05PM but there are numerous error/warning logs with FUTURE time, Like 6:23PM. I checked at 6:05PM but not sure when those errors actually happened. How ...
-1
votes
2answers
93 views

What are some benefits of clearing a Windows Event Log?

An admin on my network says he was troubleshooting an issue and had cleared the event logs. Is this a problem? What are some of the benefits of clearing the event viewer logs while troubleshooting ...
1
vote
1answer
170 views

ADFS Event 329 - Certificate Could Not Be Decrypted

Using MS scripts, I attempted a migration of an ADFS 2.0 configuration (on Windows 2008R2) to a new ADFS server (Windows 2016) server. I have warnings in my event log that seem to be linked, via the ...
1
vote
1answer
1k views

TONS of 4625 events. Failed login attempts. No IP, no username

I have a server that gets keeps getting failed login events (4625). They occur roughly every 20-30 minutes daily. Also appears to be on a schedule. I've tried deleting stored credentials. ...
0
votes
0answers
693 views

Background Tasks Infrastructure Service event id 7046

I have a server running W2K12 R2. The server experiences a string of Event ID 7011 entries in the System Event log followed by Event ID 7046. 7011 error text states "A timeout (30000 milliseconds) ...
2
votes
2answers
577 views

Windows Event Forwarding large scale with multiple domains

Let me start off explaining what I'm trying to do: We have an RMM tool installed on lots of Windows servers. It is able to send Windows Event Logs to a central store, but not in an efficient or ...
0
votes
0answers
512 views

Windows Event Forwarding (Collector Initiated Subscription) returns error code (0x32)

I've been struggling within the past few days to get the WEF working without luck. I have tried different things which I could harvest through Google, but none helped! Here is a insight to the ...
1
vote
1answer
296 views

Eventlog entries for routing table changes

someone knows if there´s a windows eventlog that informs routing table changes? I´m trying to identify a problem with one machine that has a persistent route entry that shows everytime the windows ...
0
votes
0answers
88 views

Windows Event Forwarding over NAT doesn't work where ports NOT having 1:1 mapping

I have: Collector, with HTTPS listener Non Domain Source Computer (That implies Source initiated subscription on Collector) Certificate based authentication for WinRM set up, because a requirement ...
0
votes
0answers
406 views

Export RD Gateway Logon Events per User

I have an RDS 2016 farm with 1 Gateway/Connection Broker and 4 Session Hosts. I'm looking for a way to export successful logon events for specific users. I have enabled all logging in RD Gateway Mgr->...
0
votes
1answer
370 views

Where are Windows Event Forwarding (WEF) subscriptions filters applied?

I configured Windows Event Forwarding (WEF) in my LAB domain and I'm setting up subscriptions. My subscription is configured on my DC and is source-initiated, the collector is DC01.acme.com and ...
2
votes
1answer
568 views

Can't enable Event Log

Hi I have a Windows 2012 Server and would like to do some event logging. But when I go to the event logger I am unable to Enable Logging for the desired events. (I'm logged in as the Administrator ...
-1
votes
1answer
199 views

Windows 10 pro event log file is corrupted

I'm trying to read event log with LogParser on windows 10 pro, and the query select * from security executed well. But I'm getting a message saying that the file is corrupted After executing the ...
2
votes
2answers
415 views

Remove PCs from Source-Initiated Windows Event Forwarding?

I've Googled this and haven't found any answers. (yep, I also posted on TechNet about this) I have a few workstations that have been decommissioned and are showing as "Inactive". I'd like to remove ...
0
votes
1answer
388 views

EventViewer Error “local computer may not have the necessary registry”

I am trying to review event viewer logs that was archived from another Server. When accessed, the events are listed properly, but details of each event give the following error: The description ...
0
votes
0answers
1k views

Bad password on Domain Admin from Unknown Workstation

I'm trying to trackdown the Computer/Device that has a bad password for one of our Domain Admin accounts that gets used as a shared/service account. The only details I have is a recurring event in ...
1
vote
1answer
513 views

Exporting Account Name, Domain & Timestamp from Security Auditing Event Log

I am currently exporting the last 7 days of Security microsoft windows security auditing logs via powershell to csv. It works, but with way to much detail, and also, not properly formatted. For ...
0
votes
1answer
218 views

Forward Windows 2012 event logs from workgroup host to domain host

Is this possible? I've gone through the following but no events are forwarded. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748890(v=ws.11) I ...
-1
votes
1answer
286 views

EventId 4625 without IP Address in Windows Server 2012 R2

I am registering all RDP logon failures on my Windows servers through the IP address. In Windows Server 2012 R2, in Event 4624 the Event Viewer shows me the IP, while in Event 4625 it does not. I ...
0
votes
1answer
428 views

Is it possible to view events from all event logs (including “Applications and Services Logs”) simultaneously?

One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-...
1
vote
3answers
79 views

Viewing logs for internet access through Powershell

I am just getting started with using Windows Event Viewer to view logs. I am not sure where to look for logs related to activities like: (New-Object System.Net.WebClient).DownloadFile("http://www....
1
vote
0answers
419 views

Retrieving CSR cache information for printer [Printer Name] failed

We've recently implemented a print server, which are a bunch of printers (a mixture of xerox and hp printers). For drivers, we used global drivers, and specific driver for that printer. The printers ...
1
vote
1answer
46 views

How to connect from command line to another computer with Event Viewer as another user?

I am trying to connect to another computer with Event Viewer from command line. And it can be done. However, I need to connect as another user (not my logged in user). Is there a way to do that?
1
vote
1answer
849 views

Grant access to Event Viewer “Application and Services Logs” via GPO

My monitoring team has requested to be able to read the logs under "Application and Services" in 2008/2012/2016 event viewer. These are the logs that reside in "%SystemRoot%\System32\Winevt\Logs\". ...
1
vote
1answer
1k views

Reporting Event Log content via triggered Email Windows 2012

I am able to send email based on event log triggering a Task Scheduler action which runs a powershell script. However, I am unable to pass any of the important data that this event carries. Like for ...
2
votes
1answer
358 views

Sources (protocols) for Audit Failures (Event ID 4625) in Windows Event Log

I have public-facing Windows Server 2016 virtual machine. Remote desktop port was changed from default to some number over 20,000. There is nothing of interest hosted on this VM. I just use it as a ...
0
votes
1answer
36 views

dashboard to show eventlog errors, warnings (traces) etc. [closed]

i'm after a dashboard (tfs?) to show what's currently going on with my MVC website. We write errors to the event log, and I duplicate that to a trace which I'm displaying 'live' with dbgview but I'm ...