Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What's the Windows Server 2008 equivalent of the SecEvent.Evt file? So I can open the file itself on an external computer and see who logged in.

share|improve this question
add comment

2 Answers

%SystemRoot%\System32\Winevt\Logs\Security.evtx

Note the different extension, in Server 2008/Vista the event logging system was re-written including new file formats.

Better to use the standard APIs and tools (eg. Get-WinEvent in PowerShell) to remotely access than directly accessing the file.

share|improve this answer
add comment

On my system, the path to the Security log is

%SystemRoot%\System32\Winevt\Logs\Security.evtx

but this seems to be configurable.

The general solution is, if you right click on a log in the Event Viewer and choose Properties, it will give you the path to that log.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.