Questions tagged [windows-event-log]
"Event log" usually refers to the system/server logs on Microsoft Windows machines.
613
questions
0
votes
1
answer
8
views
Windows Network Setup Service (NetSetupSvc) starts and stops every few minutes, flooding System log
NetSetupSvc is a helper service for installing network drivers and managing low-level network settings. It is trigger-started via RPC and automatically stops after 3 seconds. During normal operation ...
- 413
0
votes
0
answers
20
views
Windows Event Collector between workgroup
I configured a windows server 2016 in workgroup as windows event collector in "source computer initiated" mode. I added in the subscription configuration another windows server 2016, also ...
0
votes
0
answers
18
views
Logging hash of signed PowerShell-Scripts
I use signed PowerShell scripts within my infrastructure and log all PowerShell activity via Windows EventLog. Sadly it seem that windows does not log a hash or fingerprint of signed scripts or even ...
0
votes
0
answers
22
views
Can't get Winlogon automatic restart sign-on (ARSO) to work on a specific machine
I'm trying to get Windows ARSO to work on a machine but am unable to. (Windows 10 Pro 22H2)
It runs on other machines just fine, but not this specific machine. I've read through and double checked the ...
- 286
1
vote
1
answer
249
views
Event ID 4776 Disabled Account Failed Sign in Attempts
In our environment, I've found a handful of Event ID 4776 The computer attempted to validate the credentials for an account. Shown below is the output of that event log and it seems the user in ...
- 207
-1
votes
1
answer
136
views
Monitor Services and Event Logs on Windows Servers
We are standing up a new environment and will be installing SIEM tools, etc. in the future.
We have a few dozen Windows 2019 servers so far. I've been tasked with providing a solution for monitoring ...
1
vote
0
answers
82
views
looking for "access denied" server log entries on network shared print jobs (Windows) after removing the 'Everyone' group
In an effort to try to remove the ability for users to print directly to an MFP shared printer, relegating the users to use their badge ID for more secure printing while in the office... Currently ...
- 11
1
vote
1
answer
521
views
Which machine is actually closing the TCP socket and why?
I'm working on a C# application, handling TCP sockets.
I have a server application (Hercules) on the remote machine, trying to keep a socket open.
I have my application on my machine, subscribing to ...
- 123
2
votes
1
answer
281
views
How to enable logging of Event ID 7042 (service stop reason)?
Event with ID 7042 gets logged in the Event Log when two particular services (custom apps) stop on Windows Server 2022. The problem: one Windows Server is not logging those events. Is there an option ...
- 182
0
votes
1
answer
773
views
Hourly fatal windows alert
On one of my windows server 2012 R2 (going to upgrade), my event logger has been filled with
Event ID 36887 A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert ...
- 163
2
votes
2
answers
1k
views
Microsoft Teams filling Security Log with seProfileSingleProcessPrivilege
Recently, we started seeing a phenomenon where any machine running Microsoft Teams (office 365 E3 version) will emit event 4673 at a high rate, indicating a failed attempt to use the ...
0
votes
0
answers
50
views
Which process is writing to specific Event Viewer Log
I republished a Windows Service to change the name of the Event Viewer file it logs to. However it continues to use the old log.
I see the new one listed under Applications and Services Logs however ...
- 1
0
votes
1
answer
82
views
Repeating entries in the event viewer
Running Windows Server 2019 standard in a four node cluster. In the event viewer -> windows logs -> Application there are repeating entries.
The message is
'Windows Installer reconfigured the ...
- 192
1
vote
2
answers
119
views
How to find out & set policy in Window Server 2016. To search in security event viewer for users accidentally delete shared network folder?
I am trying to set GPO so that I can search user in event viewer who accidentally deleted the share drive in the network.
What other event IDs list can I search so that I know which category it ...
- 25
0
votes
0
answers
164
views
Windows audit "Removable Storage" not generating an event for file deletion
I have a Windows 10 system on which I have enabled removable storage audits (via GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy ...
- 3
1
vote
0
answers
612
views
Troubleshoot Kerberos pre-authentication failed logons
Once in a while we get a notification that an account triggered too many failed kerberos pre-authentication attempts.
This event contains the username and source machine. Here is an example:
Kerberos ...
- 55
1
vote
2
answers
165
views
Account audit events on DC's for Exchange and SharePoint
I recently discovered that all of our Domain controllers are no longer logging AD account logon events (Outlook Web App login - SharePoint Login) to the Security Log. But it works for RDP.
How could I ...
3
votes
2
answers
746
views
Why are logon types on Domain Controller and Workstation different
When I logon to a specific machine in an Active Directory domain, the logon type recorded in Event Viewer is 10, but the same event log on the domain controller is 3. Why are the all of logon on the ...
1
vote
1
answer
764
views
Monitoring Event ID 4660 and ID 4663 on Windows 2016 Datacenter
I want to monitor the deletion of files and folders on a Windows 2016 Datacenter Server.
I'm already monitoring event ID 4663 and event ID 4659, which have the following description:
4659: "A ...
- 13
1
vote
0
answers
1k
views
Server 2019 - Very large number of logon events per second even when not network connected?
I have a domain controller installed in my home office, 1 domain controller, 1 PC, 1 user.
I'm running Microsoft Server 2019.
When I look in the Security Event log, I see thousands of Logon (Event ID ...
- 127
0
votes
1
answer
373
views
How to register Ansible actions in Windows Event Log?
Ansible: 2.9
Windows: W2k16 Server
I'm searching for a method to register (log) Ansible actions in remote Windows host.
For example, when I work with win_command module for echo test command, I can't ...
- 13
0
votes
0
answers
65
views
Log Event ID to display time of first boot on a Windows Machine?
Say I factory reset a machine, or just installed Windows on it.
Is there a way to use Get-WinEventLog to find a log message to indicate this is the first time since the installation of the OS that the ...
- 4,869
0
votes
1
answer
925
views
What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?
I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
- 3
0
votes
1
answer
939
views
How to catch item that triggers a trigger in Task Scheduler?
I want to write a powershell script that get executed whenever a new item/eventlog entry in the eventlog 'Microsoft-Windows-TerminalServices-Gateway/Operational' gets written.
It is easy to create a ...
- 151
0
votes
1
answer
746
views
Write Windows Log entries to storage via Task scheduler job and powershell
i have created a task in Taskplaner that, whenever a new log-entry got created, it executes the following PS-script that should write the newly created eventlog-entry in a csv-file on storage.
$date =...
- 151
1
vote
0
answers
183
views
Registry Key disappearing on reboot after added to read application and services logs via WMI
I have a Windows Server 2019 VM and am trying to collect some specific Windows Event Logs using Get-WmiObject
In order to read an Event Logs channel in Applications and Services, I created a registry ...
- 11
1
vote
2
answers
27
views
Windows Events: How to interpret Failure Code
I am new to Windows Logs.
When looking at events in the events viewer the failure status and sub status show cryptic values like 0xC000006D and 0xC0000064. Besides doing a google search is there any ...
- 139
0
votes
1
answer
1k
views
What would initiate MariaDB to start to resolve IP addresses?
In my Windows Logs > Application I see these Warnings
IP address 'xxx.xxx.xxx.xxx' could not be resolved: No such host is known.
The IP is unknown to me. These Warnings get logged as:
Log Name: ...
- 220
0
votes
1
answer
1k
views
Windows event forwarding HTTPS Setup
i succesfully created a simple WEF setup between two domain server (WS2019)
it's all working great while it remain in HTTP protocol.
Once i try to take the leap to HTTPS, no more logs is going to the ...
- 29
4
votes
1
answer
11k
views
An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}
I'm getting the following error message in Azure Windows 10 Application Event log periodically:
An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {...
- 273
-1
votes
1
answer
1k
views
Directory-Service-SAM Error
In the Windows System event log, there are errors from Directory-Services-SAM. It is saying "The request for a new account-identifier pool failed. The operation will be retried until the request ...
1
vote
1
answer
320
views
How could I found net.exe activity log in windows server 2019?
I have Windows Server 2019. it is a database server(MSSQL Server) in the intranet environment.
I monitor Its Process and I found sometimes the below process runs automatically without any cause.
"...
0
votes
2
answers
150
views
How can I hide the "Actions" panel / tab / pane in Windows "Event Viewer"? [closed]
I want to get rid of the "Actions" panel in the Event Viewer. It doesn't help me. I've made it as small as possible but I just want to hide it.
- 131
-1
votes
1
answer
605
views
Non-domain Windows Event Forwarding security
Microsoft's instructions for configuring Windows Event Forwarding from event source computers to an event collector server that isn't in the same domain with the sources seems wildly problematic from ...
0
votes
0
answers
826
views
Windows Server 2012 R2, Kerberos: Should the SPN "host/localhost" exist?
I noticed that the eventlog "Microsoft-Windows-Security-Kerberos" is filled with the same entry around every minute (sometimes three times per minute, sometimes only after two or three ...
- 305
2
votes
1
answer
84
views
What Event IDs are generated in Windows server when changes are made to the login service dialog?
Is there a way to turn on logs for when changes are made to a credentials for a service like the one below?
- 4,869
1
vote
1
answer
4k
views
How to set Windows event log "Archive the log when full, do not overwrite events" option enabled with Group Policy
I want to set up my Windows server's event log "Archive the log when full, do not overwrite events" option enabled with GPO.
In my Group Plicy Management Editer, there is no policy option ...
- 13
0
votes
1
answer
873
views
Get-EventLog -Log "Microsoft-Windows-Ntfs/Operational" fails with "does not exist"
I am making a script that pulls all non-empty logs and saves them as either evtx, csv, or xml. I have got the script working for the base logs (application, security, system, etc.), and those that ...
1
vote
0
answers
150
views
Scanning all Windows event log folders for an event in a given time interval
When investigating a problem on a Windows client, I regularly find myself looking for relevant event log entries in a pretty well defined timeframe, but with no idea which of the myriad of folders in ...
- 4,061
2
votes
1
answer
507
views
RDP connection has the source IP of the host server
I came across an event on one of my windows servers,
Machine ABC has a successful incoming RDP connection from 192.168.0.16,
But the IP of machine ABC is 192.168.0.16.
Is it even possible that a ...
- 31
1
vote
1
answer
200
views
Detecting Windows Physical Console Logon
I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
- 3,881
2
votes
1
answer
2k
views
Does MS Teams write to Event log?
I'd like to trigger a script action upon MS Teams client launch. My first guess was to hook it on an event in the Event log.
However, I was unable to find if the app actually writes to the Windows ...
- 21
0
votes
1
answer
643
views
WinRM throws Error Code 2, "Unable to check the status of the Firewall" despite EVERYTHING
I am trying to set up a source initiated event Subscription from a Windows 2019 server to a Windows 10 Client. I know that might sound backwards but I don't really have a choice for a variety of ...
1
vote
0
answers
225
views
Automatization of Process Monitor inspection
I regularly use Process Monitor to to debug an application that misbehaves very often. I don't develop the application so fixing the source code is not an option. The image below shows the kind of ...
- 141
0
votes
1
answer
722
views
How to download TMF files for tracefmt from Microsoft Symbol Server
The Windows Event Tracing framework (ETW) can be used to log a lot of information about the system internals. The tracefmt.exe tool that comes with Windows SDK can be used to convert the .etl log ...
- 184
0
votes
1
answer
104
views
Network Threat Protection
Today, my Database server unexpectedly restarted. After checking it, I found that since the start of December, I was getting this event, Network Threat Protection Event. Here's the event
Object ...
1
vote
1
answer
100
views
Granular Windows Event Log Control - Log but don't retain certain event IDs
I'm messing around in VM lab and using the graylog sidecar (a process which watches the Windows event log and forwards events to a central log collector) and I have a situation where I want to send a ...
- 1,229
1
vote
1
answer
788
views
Windows Event Forwarding via https without Windows domain - no event 104
Following the suggestion in this answer, I'm trying to set up Windows Event Forwarding by following this Microsoft's guide:
Setting up a source initiated subscription where the event sources are not ...
- 113
1
vote
2
answers
334
views
Track IP Adress login RDP when shutdown happen
Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has ...
1
vote
2
answers
279
views
Configure Event Logger to log all or specific WPF events into specific log source and journal
I want to enable very noisy verbose WFP even for network packet audits. There will be a LOT of events and I'm curious if there is a way:
Specify a completely separate journal for them (not just ...
- 13