Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Unreadable Outlook Log Files

For a few weeks now we have two users who need to login into a "domain-login"-window upon starting outlook. We suspect our crm or ad fs to be responsible but can't know for sure. Therefore I'...
lkswtf's user avatar
  • 1
0 votes
0 answers
25 views

Get time taken for each process during startup

I'm able to list processes that are loaded during boot time using Get-EventLog. But I'm trying to get time taken to load for each process. $bootTime = (Get-CimInstance win32_Operatingsystem)....
r18ul's user avatar
  • 101
0 votes
0 answers
125 views

How to reduce Service Control Manager audit logging "Audit Success"

Maybe this is a niche complaint but it's bloody annoying to have Event Viewer show hundreds of Service Control Manager log entries telling me everything is fine, like: The Device Setup Manager ...
SKidd's user avatar
  • 61
-2 votes
2 answers
74 views

Continue restart on STOP 0xc00002e1 error on Windows Server 2003 domain controller

Windows Server 2003 server running raid 1. It have several problem, one of the hard drives failed and lsass.exe crashes with error 0xc00002e1. I followed this: https://learn.microsoft.com/en-US/...
Man Man Yu's user avatar
1 vote
0 answers
179 views

Why am I only seeing logoff, but no login, events in Windows Event Logs?

I want to audit when every user logged into of logged off a server via RDP. When I run Get-EventLog or Get-WinEvent and filter for Login (Event ID 4624) and Logoff (Event ID 4634) events, I only am ...
Liam Kelly's user avatar
0 votes
1 answer
87 views

What event IDs correspond to changes in Windows Add or Remove Programs dialog?

What event does Windows log when a component is registered with Windows "Add or Remove Programs" or more recently "App & features" dialog? While events with ID 11707 represent ...
Tenders McChiken's user avatar
0 votes
1 answer
416 views

Windows security event ID 4769 Kerberos Error on single user Domain

I have a test lab with a single Windows Server 2019 and a single Windows 10 Pro PC that connects to it, with a single user, me. I test our own software on it and that's it. As of the past few days I ...
SKidd's user avatar
  • 61
0 votes
1 answer
68 views

Windows Event Collector (WEF) Event Viewer unresponsive

We are using Windows Event Collector (WEF) to forward defined security events to a special server. After some days of using this solution, navigating to "Subscription" within the Event ...
HEGE's user avatar
  • 99
0 votes
0 answers
1k views

Machine account interactively signing in as UMFD. Is this normal?

Shown below is a windows log event id 4624. The log seems to convey that the machine account server2$ is trying to interactively log in as UMFD-3 interactively. From my research, UMFD is a system ...
Nina G's user avatar
  • 217
0 votes
1 answer
107 views

Backing Up Forwarded Events

I have created a simple test two liner ps script to backup parts of my event logs and the only one I can't backup is the forwarded events, is there a reason for this? The other logs back up fine with ...
Davids Learnin's user avatar
0 votes
0 answers
74 views

How can I Avoid multiple same Events in Forwarded Events in Windows Event Forwarding

We use Windows Event Forwarding to centralize our Event Logs from around 100 Server. I get multiple same Events forwarded with same Timestamp. I can't find anything to change that. It looks like this: ...
Samuel's user avatar
  • 1
0 votes
1 answer
375 views

Windows Event Collector Filtering

Afternoon and thanks for taking the time to read my question! I am testing WEC and have got it where the source device sends the logs to my collector but with some strange behavior. Both the collector ...
Davids Learnin's user avatar
0 votes
1 answer
531 views

Windows Event Log not showing log message content

Deploying new Windows Server 2022 VM. Our application - classic ISAPI with no managed code - writes events to the Application Event Log to track progress of certain processes, for debugging and ...
Vector's user avatar
  • 145
2 votes
1 answer
2k views

Two systems not showing in Windows Event Collector

I built a Windows Event Collector for the first time in our domain. The Collector server is Windows Server 2022. All the systems forwarding to it are Server 2019. The subscription is specifically for ...
user3271408's user avatar
1 vote
0 answers
90 views

Why does Application event log get cleared when I remove this custom even log

I am using powershell cmdlets to create a new event-log, register a source and log events. I experience some unexpected behavior. I created a new log with an arbitrary name by issuing the command: New-...
Krzysztof Jabłoński's user avatar
1 vote
2 answers
837 views

Separate Event Logs for Windows Event Collector

I have a Server 2019 server that I configured Windows Event Collector on. I have six systems successfully sending logs to it (specifically AppLocker logs). I'd like to expand this to to about 20 ...
user3271408's user avatar
0 votes
1 answer
2k views

Windows Network Setup Service (NetSetupSvc) starts and stops every few minutes, flooding System log

NetSetupSvc is a helper service for installing network drivers and managing low-level network settings. It is trigger-started via RPC and automatically stops after 3 seconds. During normal operation ...
theultramage's user avatar
0 votes
0 answers
88 views

Logging hash of signed PowerShell-Scripts

I use signed PowerShell scripts within my infrastructure and log all PowerShell activity via Windows EventLog. Sadly it seem that windows does not log a hash or fingerprint of signed scripts or even ...
user1667906's user avatar
1 vote
1 answer
3k views

Event ID 4776 Disabled Account Failed Sign in Attempts

In our environment, I've found a handful of Event ID 4776 The computer attempted to validate the credentials for an account. Shown below is the output of that event log and it seems the user in ...
Nina G's user avatar
  • 217
-1 votes
1 answer
269 views

Monitor Services and Event Logs on Windows Servers

We are standing up a new environment and will be installing SIEM tools, etc. in the future. We have a few dozen Windows 2019 servers so far. I've been tasked with providing a solution for monitoring ...
winsysadmin's user avatar
1 vote
0 answers
212 views

looking for "access denied" server log entries on network shared print jobs (Windows) after removing the 'Everyone' group

In an effort to try to remove the ability for users to print directly to an MFP shared printer, relegating the users to use their badge ID for more secure printing while in the office... Currently ...
Feed-Jake's user avatar
1 vote
1 answer
2k views

Which machine is actually closing the TCP socket and why?

I'm working on a C# application, handling TCP sockets. I have a server application (Hercules) on the remote machine, trying to keep a socket open. I have my application on my machine, subscribing to ...
Dominique's user avatar
  • 123
2 votes
1 answer
3k views

How to enable logging of Event ID 7042 (service stop reason)?

Event with ID 7042 gets logged in the Event Log when two particular services (custom apps) stop on Windows Server 2022. The problem: one Windows Server is not logging those events. Is there an option ...
Maris B.'s user avatar
  • 182
0 votes
1 answer
2k views

Hourly fatal windows alert

On one of my windows server 2012 R2 (going to upgrade), my event logger has been filled with Event ID 36887 A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert ...
SILENT's user avatar
  • 163
3 votes
2 answers
3k views

Microsoft Teams filling Security Log with seProfileSingleProcessPrivilege

Recently, we started seeing a phenomenon where any machine running Microsoft Teams (office 365 E3 version) will emit event 4673 at a high rate, indicating a failed attempt to use the ...
Prof Von Lemongargle's user avatar
0 votes
1 answer
272 views

Repeating entries in the event viewer

Running Windows Server 2019 standard in a four node cluster. In the event viewer -> windows logs -> Application there are repeating entries. The message is 'Windows Installer reconfigured the ...
pithhelmet's user avatar
1 vote
2 answers
219 views

How to find out & set policy in Window Server 2016. To search in security event viewer for users accidentally delete shared network folder?

I am trying to set GPO so that I can search user in event viewer who accidentally deleted the share drive in the network. What other event IDs list can I search so that I know which category it ...
OSS IT's user avatar
  • 25
0 votes
0 answers
441 views

Windows audit "Removable Storage" not generating an event for file deletion

I have a Windows 10 system on which I have enabled removable storage audits (via GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy ...
tjlds's user avatar
  • 23
1 vote
0 answers
1k views

Troubleshoot Kerberos pre-authentication failed logons

Once in a while we get a notification that an account triggered too many failed kerberos pre-authentication attempts. This event contains the username and source machine. Here is an example: Kerberos ...
MeMario's user avatar
  • 65
1 vote
2 answers
270 views

Account audit events on DC's for Exchange and SharePoint

I recently discovered that all of our Domain controllers are no longer logging AD account logon events (Outlook Web App login - SharePoint Login) to the Security Log. But it works for RDP. How could I ...
Amin Mirzanejad's user avatar
3 votes
2 answers
2k views

Why are logon types on Domain Controller and Workstation different

When I logon to a specific machine in an Active Directory domain, the logon type recorded in Event Viewer is 10, but the same event log on the domain controller is 3. Why are the all of logon on the ...
Amin Mirzanejad's user avatar
1 vote
1 answer
2k views

Monitoring Event ID 4660 and ID 4663 on Windows 2016 Datacenter

I want to monitor the deletion of files and folders on a Windows 2016 Datacenter Server. I'm already monitoring event ID 4663 and event ID 4659, which have the following description: 4659: "A ...
tortellini's user avatar
1 vote
0 answers
2k views

Server 2019 - Very large number of logon events per second even when not network connected?

I have a domain controller installed in my home office, 1 domain controller, 1 PC, 1 user. I'm running Microsoft Server 2019. When I look in the Security Event log, I see thousands of Logon (Event ID ...
Mr Fett's user avatar
  • 127
0 votes
1 answer
664 views

How to register Ansible actions in Windows Event Log?

Ansible: 2.9 Windows: W2k16 Server I'm searching for a method to register (log) Ansible actions in remote Windows host. For example, when I work with win_command module for echo test command, I can't ...
CH06's user avatar
  • 13
0 votes
0 answers
100 views

Log Event ID to display time of first boot on a Windows Machine?

Say I factory reset a machine, or just installed Windows on it. Is there a way to use Get-WinEventLog to find a log message to indicate this is the first time since the installation of the OS that the ...
leeand00's user avatar
  • 4,909
0 votes
1 answer
2k views

What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?

I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
bchen's user avatar
  • 3
1 vote
1 answer
2k views

How to catch item that triggers a trigger in Task Scheduler?

I want to write a powershell script that get executed whenever a new item/eventlog entry in the eventlog 'Microsoft-Windows-TerminalServices-Gateway/Operational' gets written. It is easy to create a ...
Chris9834's user avatar
  • 181
0 votes
1 answer
1k views

Write Windows Log entries to storage via Task scheduler job and powershell

i have created a task in Taskplaner that, whenever a new log-entry got created, it executes the following PS-script that should write the newly created eventlog-entry in a csv-file on storage. $date =...
Chris9834's user avatar
  • 181
1 vote
0 answers
412 views

Registry Key disappearing on reboot after added to read application and services logs via WMI

I have a Windows Server 2019 VM and am trying to collect some specific Windows Event Logs using Get-WmiObject In order to read an Event Logs channel in Applications and Services, I created a registry ...
AbeW's user avatar
  • 11
1 vote
2 answers
60 views

Windows Events: How to interpret Failure Code

I am new to Windows Logs. When looking at events in the events viewer the failure status and sub status show cryptic values like 0xC000006D and 0xC0000064. Besides doing a google search is there any ...
rooni's user avatar
  • 139
0 votes
1 answer
2k views

What would initiate MariaDB to start to resolve IP addresses?

In my Windows Logs > Application I see these Warnings IP address 'xxx.xxx.xxx.xxx' could not be resolved: No such host is known. The IP is unknown to me. These Warnings get logged as: Log Name: ...
MeSo2's user avatar
  • 274
0 votes
1 answer
2k views

Windows event forwarding HTTPS Setup

i succesfully created a simple WEF setup between two domain server (WS2019) it's all working great while it remain in HTTP protocol. Once i try to take the leap to HTTPS, no more logs is going to the ...
Gorshok's user avatar
  • 29
5 votes
1 answer
19k views

An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}

I'm getting the following error message in Azure Windows 10 Application Event log periodically: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {...
Maxim Masiutin's user avatar
-1 votes
1 answer
2k views

Directory-Service-SAM Error

In the Windows System event log, there are errors from Directory-Services-SAM. It is saying "The request for a new account-identifier pool failed. The operation will be retried until the request ...
Boon Chye Phang's user avatar
1 vote
1 answer
644 views

How could I found net.exe activity log in windows server 2019?

I have Windows Server 2019. it is a database server(MSSQL Server) in the intranet environment. I monitor Its Process and I found sometimes the below process runs automatically without any cause. "...
Milad Habibian's user avatar
1 vote
2 answers
260 views

How can I hide the "Actions" panel / tab / pane in Windows "Event Viewer"? [closed]

I want to get rid of the "Actions" panel in the Event Viewer. It doesn't help me. I've made it as small as possible but I just want to hide it.
mnemotronic's user avatar
-1 votes
1 answer
1k views

Non-domain Windows Event Forwarding security

Microsoft's instructions for configuring Windows Event Forwarding from event source computers to an event collector server that isn't in the same domain with the sources seems wildly problematic from ...
George Glynn's user avatar
0 votes
0 answers
1k views

Windows Server 2012 R2, Kerberos: Should the SPN "host/localhost" exist?

I noticed that the eventlog "Microsoft-Windows-Security-Kerberos" is filled with the same entry around every minute (sometimes three times per minute, sometimes only after two or three ...
Larsen's user avatar
  • 343
2 votes
1 answer
170 views

What Event IDs are generated in Windows server when changes are made to the login service dialog?

Is there a way to turn on logs for when changes are made to a credentials for a service like the one below?
leeand00's user avatar
  • 4,909
1 vote
1 answer
8k views

How to set Windows event log "Archive the log when full, do not overwrite events" option enabled with Group Policy

I want to set up my Windows server's event log "Archive the log when full, do not overwrite events" option enabled with GPO. In my Group Plicy Management Editer, there is no policy option ...
Sako's user avatar
  • 13

1
2 3 4 5
13