Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Disable Microsoft Office Telemetry not working properly. Data Logging Locations very confusing

Due to the Data Privacy regulations in our Country we have been asked by management to disable Microsoft Office Pro Plus, 365, 2016 from sending Telemetry Data to Microsoft so i did the following as ...
0
votes
1answer
18 views

Windows Event Forwarder for Workgroup Computers - Is it possible?

I have 2 Windows Server 2016 boxes (a forwader and a collector). They are in the same subnet and both are workgroup. Unfortunately, these servers cannot be joined to any domain. Just as the ...
1
vote
1answer
155 views

Access Denied WinRM Error Code 5

We are trying to set up Windows Event Forwarding (WEF) in our environment and we are running into a few issues. We have a GPO set up (shown below) to enable the forwarding of events to a local ...
0
votes
1answer
48 views

Windows Event Forwarding, Source-Initiated By Way Of AD Security Group?

I'm setting up Windows Event Forwarding (WEF) utilizing a source initiated subscription type. In that source initiated subscription - select computer groups area I've successfully tested entering an ...
0
votes
1answer
73 views

Azure : How to process Azure Log events from Event hub and filter based on criteria

How to process Azure Log events from Event hub and filter based on criteria. We are trying to filter specific critical or security related Diagnostic and Activity logs before feeding into our Onprem ...
1
vote
0answers
37 views

Server Under Attack

I had my server under 2 firewalls. One from my router and one from my windows server. Only VPN port was acccessible. Recently I was getting failed login attempts daily with changing usernames from ...
2
votes
1answer
66 views

What time zone does windows event logs show

I have a doubt on the time zone shown in the windows event logs. I had read that if I export the windows event logs from another machine and open it in my machine which has a different time zone, the ...
1
vote
2answers
53 views

What is the most efficient way to take a list of Windows Event IDs and determine which audit policy enables logging of the event?

I have about 1500 Windows servers in my environment, 1000 or so 2012 R2 and 500 2016. I have a list of about 150 event IDs that I have been told to log and archive. I don't know which audit policy I ...
1
vote
1answer
1k views

No NPS (Network Policy Server) Event Logs

Running into something very painful. We use Microsoft's Network Policy Server, and need the Network Policy Server security event subcategory to work - specifically, event id 6273 and 6272. NPS works,...
0
votes
1answer
25 views

Event 4656 on file server for files and folders not opened

Can someone explain why on the audit events of a file server there's plenty of 4656 events even if the file or folders have not directly been opened? For example, if you open the root directory H: , ...
1
vote
1answer
64 views

Configure IIS 7 to create a Windows event on HTTP error (or to trigger an action)

How to configure IIS 7 so it creates a Windows event every time an HTTP error occurs? The closest thing I found is this: https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524984(v%3Dvs....
2
votes
2answers
236 views

How do I interpret ID 4624 Type 3 events on a domain controller?

I'm seeing a lot of ID 4624 Events (Logon Type 3) on a domain controller (Windows Server 2012) and I'm wondering what those events want to to tell me. I've read that 4624 Type 3 events on a domain ...
2
votes
0answers
658 views

Windows not collecting logs. Error: The WinRM service is not listening for WS-Management requests

I am getting this error The WinRM service is not listening for WS-Management requests. User Action If you did not intentionally stop the service, use the following command to see the WinRM ...
2
votes
1answer
74 views

Issue with Powershell script not filtering by date

I've put together this powershell function to basically pull events from the NPS log (Specifically denied authentication attempts) from the last point the script was run (the $date variable), sort out ...
0
votes
1answer
33 views

How to filter Event Viewer for a single website?

I am trying to find out each concurrences for an error happening on a website I managed to create an XML query to filter by EventID <QueryList> <Query Id="0" Path="Application"> <...
0
votes
1answer
179 views

Rsyslog not logging Windows Events

I am trying to configure sending Windows Events to rsyslog server, but rsyslog ignores them. $EscapeControlCharactersOnReceive off template(name="OnlyMsg" type="string" string="%msg:::drop-last-lf%\...
0
votes
0answers
33 views

Windows Server 2012R2 Event Log app does not show actual log contents

I have a service application which added its own Event Log, so it is visible under the Applications and Services Logs node in the Event viewer. I recently installed the service on a Windows 2012 R2 ...
0
votes
0answers
195 views

Collecting Security Log Data in Azure Log Analytics

Can anyone help advise on how we monitor the security logs in Azure log analytics specifically for event 4689? I only seem to have objects for SecurityEvent and CommonSecurityLog, but these both ...
0
votes
1answer
167 views

Annotate Windows event logs shipped with Windows Event Forwarding (WEF)

Looking for a way to annotate Windows event logs shipped with Windows Event Forwarding - specifically, looking to tag each log with the MAC address/es of the originating system. Would like to do this ...
1
vote
1answer
1k views

IP Address Change event id for Windows 10?

Is there an event id / log / log source for when an ip, gateway, netmask changes in Windows 10?
0
votes
0answers
113 views

WEF error 5004 on server 2019

Having a really annoying issue with WEF configured in push mode on server 2019. It is a domain controller, appropriate permissions are set on the logs and correct URL over HTTP for the subscription ...
2
votes
1answer
47 views

Get rid of explanation in windows message log

I am wondering if it is possible to get rid (or simply not store in the first place) the "explanation" inside the events with a specific id, as e.g., event of class 4624 (win2008). Although the ...
0
votes
0answers
30 views

How to effectively track successful logins and logouts?

I need to audit all successful logins and logouts on a server. Currently I am using Security Event Log and Powershell to track this. However I get a lot of extra noise, one login will generate three ...
1
vote
0answers
204 views

Event Forwarding Broken - Wecutil.exe command gets stuck

I am writing a software program that relies very heavily on event forwarding. It uses a collector-initiated subscription. After the subscription is created it works fine, as expected. Sometime later, ...
0
votes
0answers
122 views

MR_MONITOR events on Windows 2012 R2 Hyper-V host coincide with slowdowns on virtual machines

We are running Windows Server 2012 R2 with Hyper-V enabled on a Cisco C240 M5SX. Whenever anyone logs into this host it creates several MR_MONITOR events which coincide with slowdowns on every ...
0
votes
0answers
91 views

How to tell how long it took for a RDP Session to establish a connection?

Are there logs, or fields inside of logs that tell when the connection was initiated and established? Inside of Event ID 4624 there is a TimeCreated [SystemTime] field, but I am hoping to audit how ...
0
votes
0answers
91 views

Win32_NTLogEvent query rendering data with 1 hour latency with event viewer

Trying to collect the event log data with WMI query using class Win32_NTLogEvent.But this is not sync with event viewer data.The WMI query rendering data with 1 hour latency with event viewer.Hence ...
1
vote
1answer
758 views

Can't Find Failed Authentication in Event Viewer

I'm trying to gather failed login/authentication events from DC's on a 2016 Domain. I can see 4625 Audit Failure events in the Security Logs on the Domain Controllers when a user fails to login at ...
1
vote
0answers
795 views

Security audit failure: Event ID 5061 logged on IIS server

Recently the following audit failure event is being logged in the Windows Security event log of a Server 2012 R2 server running a Internet-facing IIS server: Source: Microsoft Windows ...
1
vote
1answer
1k views

Windows Server 2016 and Windows 10: Cannot set up Windows Event Forwarding via HTTPS

Alright so I've been trying to set up Windows Event Forwarding via HTTPS for a while now and in the process, I've hit my share of errors that I managed to address one by one, but now I've been stuck ...
1
vote
0answers
14 views

How to find out if a specific file was accessed by a process and denied access?

I was recently trying to install an SSL certificate and I was unaware of which account was being used on IIS to access it. I thought that maybe if I looked in the Security log I would find out what ...
2
votes
2answers
388 views

Permissions changes on Windows event log are not working (GPO change)

I'm trying to grant permissions to the Network Service account (SID S-1-5-20) on the event log "Microsoft-Windows-CAPI2/Operational" (see picture below). However I need to push this change on more ...
5
votes
1answer
776 views

Event Descriptions Missing From Get-EventLog but present in Get-WinEvent and Event Viewer

Many of the event descriptions for event log events are missing when I query them in powershell with Get-EventLog but they are present when I query them in powershell with Get-WinEvent or view them in ...
3
votes
0answers
331 views

[WINDOWS]: identifying new protected accounts based on ID 4780

As a security best practice, I would like to keep track in my Windows Active Directory domain of any new "Protected Accounts and Groups". According Microsoft, this concerns any user or group which is ...
0
votes
1answer
53 views

wevtutil without admin permissions

Is it possible to install a provider without admin permissions? whenever I try something like wevtutil im MyManifest.man I got 'Access is denied.'. If I run the same command in an admin command ...
0
votes
1answer
978 views

Session “NT Kernel Logger” failed to start

I have encountered an error on windows server 2012 recently. Session "NT Kernel Logger" failed to start with the following error: 0xc0000022 More Details: LogName: Microsoft-Windows-Kernel-...
0
votes
2answers
42 views

Is there unique information or other reasons a Windows event 'Message' should not be discarded?

Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system? Is it the case that these are composed of data from other attributes, ...
2
votes
1answer
1k views

filtering event logs with specific TIME range of ANY day

How can I query windows server events between two times of any day? I have tried with PowerShell... Get-EventLog -Logname xxxx -After 04:00:00 -Before 04:00:30 ...but just returns today's events
2
votes
1answer
489 views

system center operation management ( SCOM ) log collection and full text searching

I want to collect all events in all windows servers (nearly 50 server) (from windows event viewer) in SCOM, and full text search on it. My question is: how can I do it?
1
vote
1answer
500 views

Filter Windows Event Security logs by a range of Source IP Address

So i know you could filter by a Source IP Address. But what if you want to filter by a range of Source IP address. i tried <QueryList> <Query Id="0" Path="Security"> <Select ...
0
votes
1answer
42 views

Windows - Alert on Event Log failure [closed]

I need to display a local alert when Windows Event Log fails. Other than creating a script that is triggered as part of the service recovery options, is there another way to accomplish this?
0
votes
0answers
3k views

Event log error for Microsoft-Windows-Perflib ID 1008

I started seeing the following error in my Windows Server 2012 event application logs somewhat recently, possibly after installing some Windows updates. Log Name: Application Source: ...
2
votes
1answer
1k views

Windows Backup / wbadmin errors | Source: SPP | Event id: 16389 | Increase SPP CreateTimeout?

After a reboot we encounter while the first backup (wbadmin) on a Windows Server 2016 these errors in the eventlog: Source: SPP Event ID 16389 Details: The writer's timeout expired between the ...
1
vote
2answers
119 views

Windows server 2016 Security Log - Remove extra description text?

Preface once again: I'm a Linux admin. Is there any way to reduce the verbosity of Windows Server Security Log messages? For example, every logon event "4624" has this extra text describing what a ...
1
vote
0answers
219 views

EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?

I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On ...
1
vote
0answers
257 views

Logging of MySQL Queries and Forwarding to Syslog/Event log

I was to able to enable Error log, General Query log, Slow Query Log and Binary Log and was able to forward the logs to Syslog. I have few questions about logging. 1) The error log is automatically ...
3
votes
2answers
236 views

Windows Server File Share Audit File Attribute Modification

My goal is to identify what user has set the Hidden attribute on a file within the local file share. I have enabled File Share access auditing as per this article. In short: Added a group policy ...
3
votes
1answer
2k views

Execute a Windows task triggered by registry changes

I'm looking for a possibility to execute a script in case a particular registry key is going to be created or modified. In the Windows Taks Scheduler there is a way to execute scripts triggered by ...
2
votes
1answer
696 views

Windows 2016 Server Event Date Time is in Future

Current machine date time is Sept 25th 2018 06:05PM but there are numerous error/warning logs with FUTURE time, Like 6:23PM. I checked at 6:05PM but not sure when those errors actually happened. How ...
-1
votes
2answers
166 views

What are some benefits of clearing a Windows Event Log?

An admin on my network says he was troubleshooting an issue and had cleared the event logs. Is this a problem? What are some of the benefits of clearing the event viewer logs while troubleshooting ...

1
2 3 4 5
12