2022 Developer Survey is open! Take survey.

Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

Server 2019 - Very large number of logon events per second even when not network connected?

I have a domain controller installed in my home office, 1 domain controller, 1 PC, 1 user. I'm running Microsoft Server 2019. When I look in the Security Event log, I see thousands of Logon (Event ID ...
user avatar
  • 117
0 votes
0 answers
21 views

Tool to calculate cpu time between certain ETW events

I'm trying to measure the kernel and usermode time spent in certain blocks of C++ code. I know about GetProcessTimes but since there's ETW i could also provide events for enter and leave of the blocks ...
user avatar
0 votes
1 answer
44 views

How to register Ansible actions in Windows Event Log?

Ansible: 2.9 Windows: W2k16 Server I'm searching for a method to register (log) Ansible actions in remote Windows host. For example, when I work with win_command module for echo test command, I can't ...
user avatar
  • 13
0 votes
0 answers
13 views

Log Event ID to display time of first boot on a Windows Machine?

Say I factory reset a machine, or just installed Windows on it. Is there a way to use Get-WinEventLog to find a log message to indicate this is the first time since the installation of the OS that the ...
user avatar
  • 4,767
0 votes
1 answer
70 views

What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?

I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
user avatar
  • 3
0 votes
1 answer
22 views

How to catch item that triggers a trigger in Task Scheduler?

I want to write a powershell script that get executed whenever a new item/eventlog entry in the eventlog 'Microsoft-Windows-TerminalServices-Gateway/Operational' gets written. It is easy to create a ...
user avatar
  • 111
0 votes
1 answer
43 views

Write Windows Log entries to storage via Task scheduler job and powershell

i have created a task in Taskplaner that, whenever a new log-entry got created, it executes the following PS-script that should write the newly created eventlog-entry in a csv-file on storage. $date =...
user avatar
  • 111
0 votes
0 answers
131 views

Azure Health Monitoring Agent

We have been having servers just stop responding and we have to do a hard reset on them. We have been searching for a cause and solution to this issue, as it appears to be happening more frequently. ...
user avatar
1 vote
0 answers
27 views

Registry Key disappearing on reboot after added to read application and services logs via WMI

I have a Windows Server 2019 VM and am trying to collect some specific Windows Event Logs using Get-WmiObject In order to read an Event Logs channel in Applications and Services, I created a registry ...
user avatar
  • 11
1 vote
2 answers
21 views

Windows Events: How to interpret Failure Code

I am new to Windows Logs. When looking at events in the events viewer the failure status and sub status show cryptic values like 0xC000006D and 0xC0000064. Besides doing a google search is there any ...
user avatar
0 votes
1 answer
260 views

What would initiate MariaDB to start to resolve IP addresses?

In my Windows Logs > Application I see these Warnings IP address 'xxx.xxx.xxx.xxx' could not be resolved: No such host is known. The IP is unknown to me. These Warnings get logged as: Log Name: ...
user avatar
  • 203
0 votes
1 answer
273 views

Windows event forwarding HTTPS Setup

i succesfully created a simple WEF setup between two domain server (WS2019) it's all working great while it remain in HTTP protocol. Once i try to take the leap to HTTPS, no more logs is going to the ...
user avatar
  • 11
0 votes
0 answers
30 views

MS SQL-Server 2014 - Is it possible to trigger an Event/Script, when a certain Query comes along?

I'd like to have the possibility to accomplish a certain routine (fi. trigger a external node script or any kind of script/method whatever), when certain queries come along in MS SQL Server 2014. Is ...
user avatar
  • 181
3 votes
1 answer
2k views

An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}

I'm getting the following error message in Azure Windows 10 Application Event log periodically: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {...
user avatar
-1 votes
1 answer
231 views

Directory-Service-SAM Error

In the Windows System event log, there are errors from Directory-Services-SAM. It is saying "The request for a new account-identifier pool failed. The operation will be retried until the request ...
user avatar
1 vote
1 answer
48 views

How could I found net.exe activity log in windows server 2019?

I have Windows Server 2019. it is a database server(MSSQL Server) in the intranet environment. I monitor Its Process and I found sometimes the below process runs automatically without any cause. "...
user avatar
0 votes
2 answers
72 views

How can I hide the "Actions" panel / tab / pane in Windows "Event Viewer"? [closed]

I want to get rid of the "Actions" panel in the Event Viewer. It doesn't help me. I've made it as small as possible but I just want to hide it.
user avatar
0 votes
0 answers
96 views

How can I troubleshoot the "specified input settings" for a WEF listener?

I'm trying to set up source-initiated Windows Event Forwarding, per the instructions on e.g. https://docs.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription. I have tried ...
user avatar
  • 103
0 votes
0 answers
57 views

Getting Error ID 4625 for a mapped drive but user can access drive

We have a work machine that can access a mapped network drive just fine but the server (2012 R2) is throwing out Audit Failure Error ID 4625 An account failed to log on. Failure Information: Failure ...
user avatar
  • 1
0 votes
0 answers
196 views

WinRM "Access Denied" Cross Domain

I have SERVER1 in DOMAINA and SERVER2 in DOMAINB. There is a firewall between the domains. SERVER1 is running Windows 2012 R2 and SERVER2 is running Windows 2016 Std. SERVER1 is a domain controller ...
user avatar
  • 1
-1 votes
1 answer
81 views

Non-domain Windows Event Forwarding security

Microsoft's instructions for configuring Windows Event Forwarding from event source computers to an event collector server that isn't in the same domain with the sources seems wildly problematic from ...
user avatar
0 votes
0 answers
152 views

Windows Server 2012 R2, Kerberos: Should the SPN "host/localhost" exist?

I noticed that the eventlog "Microsoft-Windows-Security-Kerberos" is filled with the same entry around every minute (sometimes three times per minute, sometimes only after two or three ...
user avatar
  • 305
0 votes
0 answers
66 views

Missing Built-in security principals in Object Types Windows

I need to add the NT AUTHORITY/NETWORK SERVICE to Event log readers on some source computers for a Event Subscription, to use Security events, but I dont have listed the Built-In security principals ...
user avatar
2 votes
1 answer
47 views

What Event IDs are generated in Windows server when changes are made to the login service dialog?

Is there a way to turn on logs for when changes are made to a credentials for a service like the one below?
user avatar
  • 4,767
1 vote
1 answer
925 views

How to set Windows event log "Archive the log when full, do not overwrite events" option enabled with Group Policy

I want to set up my Windows server's event log "Archive the log when full, do not overwrite events" option enabled with GPO. In my Group Plicy Management Editer, there is no policy option ...
user avatar
  • 13
0 votes
1 answer
309 views

Get-EventLog -Log "Microsoft-Windows-Ntfs/Operational" fails with "does not exist"

I am making a script that pulls all non-empty logs and saves them as either evtx, csv, or xml. I have got the script working for the base logs (application, security, system, etc.), and those that ...
user avatar
0 votes
0 answers
71 views

Scanning all Windows event log folders for an event in a given time interval

When investigating a problem on a Windows client, I regularly find myself looking for relevant event log entries in a pretty well defined timeframe, but with no idea which of the myriad of folders in ...
user avatar
2 votes
1 answer
103 views

RDP connection has the source IP of the host server

I came across an event on one of my windows servers, Machine ABC has a successful incoming RDP connection from 192.168.0.16, But the IP of machine ABC is 192.168.0.16. Is it even possible that a ...
user avatar
  • 31
1 vote
1 answer
110 views

Detecting Windows Physical Console Logon

I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
user avatar
  • 3,791
2 votes
1 answer
736 views

Does MS Teams write to Event log?

I'd like to trigger a script action upon MS Teams client launch. My first guess was to hook it on an event in the Event log. However, I was unable to find if the app actually writes to the Windows ...
user avatar
0 votes
1 answer
278 views

WinRM throws Error Code 2, "Unable to check the status of the Firewall" despite EVERYTHING

I am trying to set up a source initiated event Subscription from a Windows 2019 server to a Windows 10 Client. I know that might sound backwards but I don't really have a choice for a variety of ...
user avatar
1 vote
0 answers
142 views

Automatization of Process Monitor inspection

I regularly use Process Monitor to to debug an application that misbehaves very often. I don't develop the application so fixing the source code is not an option. The image below shows the kind of ...
user avatar
  • 131
0 votes
1 answer
363 views

How to download TMF files for tracefmt from Microsoft Symbol Server

The Windows Event Tracing framework (ETW) can be used to log a lot of information about the system internals. The tracefmt.exe tool that comes with Windows SDK can be used to convert the .etl log ...
user avatar
  • 185
0 votes
1 answer
44 views

Network Threat Protection

Today, my Database server unexpectedly restarted. After checking it, I found that since the start of December, I was getting this event, Network Threat Protection Event. Here's the event Object ...
user avatar
1 vote
1 answer
27 views

Granular Windows Event Log Control - Log but don't retain certain event IDs

I'm messing around in VM lab and using the graylog sidecar (a process which watches the Windows event log and forwards events to a central log collector) and I have a situation where I want to send a ...
user avatar
  • 1,179
1 vote
1 answer
441 views

Windows Event Forwarding via https without Windows domain - no event 104

Following the suggestion in this answer, I'm trying to set up Windows Event Forwarding by following this Microsoft's guide: Setting up a source initiated subscription where the event sources are not ...
user avatar
  • 113
1 vote
2 answers
113 views

Track IP Adress login RDP when shutdown happen

Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has ...
user avatar
1 vote
2 answers
152 views

Configure Event Logger to log all or specific WPF events into specific log source and journal

I want to enable very noisy verbose WFP even for network packet audits. There will be a LOT of events and I'm curious if there is a way: Specify a completely separate journal for them (not just ...
user avatar
  • 13
1 vote
0 answers
287 views

AWS Server Stuck In Unreachable State - Service Become Stuck in "Stopping/Starting" State

I have a development box that is (nearly every night) experiencing the same symptoms: Can't RDP due to the "Black Screen of Death" Can't issue remote powershell commands because the "...
user avatar
2 votes
1 answer
4k views

Event ID 1000 Application Error cmd.exe kernelbase.dll

I've come across a re-occuring error in the event logs of my Windows 2012 R2 Hyper-V server. The error event is shown below. Error 16/12/2020 15:47:31 Application Error 1000 (100) Faulting ...
user avatar
1 vote
1 answer
917 views

Kerberos pre-authentication failed for unused Administrator account on domain controllers [duplicate]

Our three Active Directory domain controllers are collectively reporting thousands of 'Kerberos pre-authentication failed' events a week, where the IpAddress field is of a domain controller (but ...
user avatar
  • 6,663
1 vote
1 answer
76 views

Task scheduler Event trigger on user mail field change

How I could trigger Task Scheduler event when user mail field changed (or any custom attribute) in Active Directory? We want to run Powershell script when user mail field changes. Event ID: 4738, ...
user avatar
1 vote
0 answers
1k views

The loghttp module error - strange issue that fills up the Application windows log

I have a AWS VM used as web server with IIS. Recently I noticed the following error that fills up the Application windows log. The log message is added to Application log every few seconds, and out of ...
user avatar
  • 187
2 votes
1 answer
53 views

How can I tell if a user group modification event is triggered due to group policy instead of manual action?

I'm to trigger an alert if users are manually added to an administrators group based on the content of a windows event. Here's an example of the event (with some stuff sanitized) { "...
user avatar
  • 11.4k
1 vote
1 answer
64 views

Event log and performance counters correlation

Anyone else often having a need to correlate multiple log sources such as event log or various log files with performance counters when troubleshooting Windows machines? For example, we had a case of ...
user avatar
  • 11
1 vote
1 answer
362 views

Event 1007: The share denied anonymous access to the client

the body of evevnt is: " **The share denied anonymous access to the client. Client Name: \10.139.70.35 Client Address: 10.139.70.35:49157 Share Name: \*\in Share Path: ??\C:\Users\jodat\Desktop\...
user avatar
1 vote
1 answer
496 views

Use powershell to retrieve Event Forwarding state and configuration

I need to know if the current Windows client has enable Windows Event Fowarding, and where is it forwarding to. Can I do this with powershell? I couldn't find anything relative on Google, does anyone ...
user avatar
  • 707
1 vote
0 answers
35 views

how to view old events in failover cluster manager

In failover cluster manager > cluster events, i have only for about 12 hour of events. I wish to view older ones or maybe how to make the manager show more than that.
user avatar
  • 111
1 vote
1 answer
29 views

Info about Event logs (Active directory)

Recently 3 of my Active directory admins are unable to login to AD server through RDP. After we cross checked everything, we found these 3 users are added in one security group called "Deny RDP ...
user avatar
2 votes
1 answer
63 views

When setting up Windows EventLog Forwarding (WEF), does the forwarding machine keep a local copy of the log?

I am curious if the server forwarding said logs keeps a local copy in addition to forwarding, or if all logs it generates are immediately forwarded to the collector? I cannot find detailed information ...
user avatar
  • 131

1
2 3 4 5
13