Questions tagged [event-log]
The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.
384
questions
23
votes
6
answers
283k
views
How to check the event log (if any) for network failure?
Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
1
vote
1
answer
23k
views
How to log a shutdown caused from overheating or overheated components?
On a Windows 7 SP1 machine, I would like to know how I could reliably log a shutdown that was caused exclusively from overheated components of the machine.
Since the component that overheats must ...
0
votes
1
answer
876
views
How to make wevtutil tool return results in UTF-8 format?
I'm writing a script that requires me to look up a specific event in the Windows Event Log using wevtutil tool. The command line goes as such:
wevtutil qe System /q:"*[System[Provider[@Name='...
1
vote
1
answer
2k
views
How to log executed batch files?
Let's say I executed 5 batch files yesterday and now I want to know the order of the execution of the files. Does Windows log the execution, maybe in Windows Event Logs or something? Or is there any ...
1
vote
1
answer
106
views
Are there negative consequences to disabling audit policies?
I'm the sole user of my own laptop running Windows 8.1. After doing a bit of research into this (eg. SuperUser question and Microsoft Technet), I can see how this might be useful for a company laptop.
...
0
votes
1
answer
1k
views
How can I change the port of the Event Log on Windows 7
I have following problem.
I have a Linux device connected to a PC over a USB with pipe that is configured as network device and is correctly recognized by Win7 in device manager. This Linux device ...
1
vote
2
answers
5k
views
Export Windows XP event logs cmd
I need to export a specific Windows XP event log from the eventviewer to a ".txt" file.
My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
0
votes
1
answer
50
views
Tracing storage media ejects and disconnects
I had a SD card that I kept permanently plugged into my laptop. Had, until I noticed it was missing this week. I don't know when exactly it fell out, the laptop may or may not have been in suspend at ...
21
votes
3
answers
71k
views
Upgrade to Windows 10 Pro, version 1511, 10586 errors with 0x8024200D
I have seen a few people with this problem on forums, but nobody seems to have a solution yet.
Windows says I should restart because I have an update pending (this is 10586). During restart there is ...
2
votes
0
answers
2k
views
If ESENT complains that it cannot create its logfile, is it avoidable?
In my installation of Windows 10 on a fairly new machine that shipped with it, I get a lot of errors in my eventvwr log, and some of them I feel are indicative of why my system hits 100% disk use for ...
0
votes
2
answers
809
views
Windows 7 Home Premium: Event ID 4624: Someone logged in when I was away
I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following:
28/10/2015 14:54:25 Event ID 4624 (access type: 2)
28/10/...
2
votes
1
answer
3k
views
Difference between Windows events 4801 and 4624
(for background, see: In Windows 7, How to query times, when the computer was locked?)
It seems that there are two entirely separate events that may be generated in the windows event log when a ...
2
votes
1
answer
671
views
Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events
I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
1
vote
1
answer
733
views
How can I see which programs were ran by the user?
Programs & Features (or even better Nirsoft's MyUninstaller) tell me the program installed, and I can accessed some cached installation data, but is there a way to get a log of the executables ...
1
vote
1
answer
6k
views
Why are there so many unexpected shutdowns in the event log?
I was looking through my shutdown history in the event log today when I noticed that there was an "Unexpected Shutdown" (event ID 6008) logged way more often than I can ever recall there being ...
5
votes
2
answers
12k
views
Disable windows powershell event logging
I'm using PsExec to run PowerShell scripts on remote machines and as a side effect of this, the "Windows PowerShell" event-log (found in the Event Viewer under "Applications and Services Logs") is ...
8
votes
1
answer
11k
views
Audit failure 5061 after logging in to Windows 10
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task ...
0
votes
1
answer
1k
views
see all logins and attempts in windows 7
There any way to get the dates and times of logins on a computer with windows 7 (Local and Remote)
I read this article, but in events viewer I cant see any login (All events are other types)
We ...
1
vote
0
answers
83
views
Windows 8 Boot Reason
My friend asked me to troubleshoot an issue where his Windows 8.1 desktop would boot up automatically roughly 24 hours after previous shutdown. I'm really sceptical about it but the Event Viewer log ...
0
votes
0
answers
853
views
Windows 2012 Server - Audit Who Logged User Off
Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
3
votes
1
answer
1k
views
How do I Defrag/Optimize a Windows 8.1 Volume which has no Drive Letter? Does it matter?
I have a Dell Inspiron Ultrabook running Windows 8.1 (64-bit). In File Explorer, I click on Drive C Properties -> Tools -> Optimize. There I see 4 drives listed as follows:
OS (C:) -- OK (0% ...
0
votes
1
answer
47
views
How do I log file writes to a directory on Windows Server 2003?
I handle some network administration for a small business. Recently, I discovered a set of windows backup files in a directory that was being regularly added to (multiple times daily) on our backup ...
0
votes
0
answers
3k
views
Windows 10 constant graphics driver crashing for no apparent reason
I recently bought asus gtx 750 oc card, installed it with its driver on windows 7 and it worked fine. Indidntnuse it too long but longer than I could run it on windows 10 without a problem. http://m....
1
vote
1
answer
38
views
USB Event Log when computer powered down
I had a GoPro stolen from my computer at my work desk last night (I'm assuming). The GoPro was connected to one of my USB ports, and I was wondering if Windows tracked that information somehow? I have ...
2
votes
1
answer
19k
views
A series of DeviceSetupManager warnings in Windows 10 event logs
I have been "cleaning up" Windows 10, and I'm noticing a series of warnings in the Event Viewer every time I start Windows. And they are in the following order.
Event 202, DeviceSetupManager
"The ...
3
votes
3
answers
7k
views
Windows 7 losing network connection randomly when other PC's are connected
I'm having quite an annoying problem which I haven't been able to find a solution for yet. I hope you can help me.
When my PC was using my home network and was connected to the internet through a ...
0
votes
1
answer
1k
views
Determining Cause of Unexpected Shutdown on Windows 8.1
I left my computer unattended a little over half an hour while it was compressing some files. I came back, and my computer had apparently shut off. I looked at the Event Logs, and it told me that
The ...
2
votes
1
answer
134
views
How can I receive e-mails based on certain Windows Firewall events?
Is it possible to receive an e-mail when Windows Firewall logs certain events (such as an inbound connection being accepted for example)?
1
vote
0
answers
216
views
File delete audit, Windows 8
I have a shared folder (folderA) and our users must copy some files everyday and after they finish working they have to delete files and when they delete files there must be a record.(for security ...
3
votes
1
answer
7k
views
Many successful logon and logoff requests in Windows Event Viewer
I'm getting thousands of logon and logoff requests every day from the same computer in the local network. It seems the computer is connecting from a different port every time.
What could be the cause ...
2
votes
1
answer
6k
views
Equivalent of wevtutil in powershell?
wevtutil is a command in cmd for displaying Windows logs in different formats.
What is the equivalent cmdlet in Powershell?
1
vote
1
answer
63
views
Searching for a GPO's Name in a Windows 7 Event Log?
Is there a way to search for a particular string (a GPO) in a Windows Event Log Message? Instead of searching for an Event ID or filtering by event type?
0
votes
1
answer
186
views
Get Notified of Errors in Windows Event Log
I wrote a powershell script to make a database dump that I plan on having run nightly with Windows Task Scheduler. It outputs to a log file so I can make sure everything is working, but I want to be ...
2
votes
0
answers
853
views
How come UAC logs are not being stored in Event Viewer?
In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
0
answers
851
views
How To Read NFC event?
I have an external NFC reader connected via usb to a Windows-7, with the drivers installed.
It seems to work, as when I place a NFC card on the reader its led changes from red to green and the PC ...
1
vote
1
answer
3k
views
Windows security log shows mysterious user logins
In troubleshooting an unrelated problem, I noticed that one user's (Jeny) Windows security log showed several logins and logoffs from another user (Holly). Holly confirms that she logged into her ...
1
vote
2
answers
3k
views
ID disk from event message [duplicate]
I have the following event in Event Viewer:
"The driver detected a controller error on \Device\Harddisk6\DR19."
Log Name: System
Source: Disk
EventID: 11
Level: Error
How do I know what disk this ...
2
votes
2
answers
5k
views
How to target an event by the process name as well as the ID?
I have managed to create a scheduled task that will be triggered by an event ID. For example, I have a task that will run winver.exe whenever event ID 4688 is logged. So if I run notepad.exe from Run ...
1
vote
1
answer
1k
views
Mysterious event log message
I saw this message in my event log today. I tried searching on it without much success.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider ...
0
votes
1
answer
179
views
View users login activity
Is there a way from the local event logs of a windows 7 computer to tell when the users logged into the cpu?-
I see logon 4624 / logoff 4634
But those seem to be every 30min or so not tied to users ...
0
votes
1
answer
2k
views
Does Windows log when a user attempts to execute an application that is not on the whitelist?
I have searched Google with several search terms, attempting to discover if Windows logs when a user attempts to run an application that is not whitelisted, and if so, in what event log.
Can anyone ...
1
vote
1
answer
2k
views
Recurring event in Event Log: "Windows Security Center Service could not stop Windows Defender"
I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes):
The Windows Security ...
1
vote
0
answers
63
views
Analysis to extract task flows from UI event log
Given a table of UI events, how can I detect task flows, task loops, and behavioural patterns?
I'm instrumenting my software to track what the user does. Controls clicked, keys pressed, and so on, ...
4
votes
1
answer
6k
views
Is there a trace of users killing a process on windows machine
We're debugging a situation in a retail location where the program does a bunch of logging but then everything just stops. it's pretty apparent that the comm to an external web service is taking some ...
1
vote
1
answer
639
views
Accessing Server 2008 R2 manual shutdown notes and event logs
When I manually reboot a server I am required to specify a reason for the restart and given the opportunity to provide a comment. How do I review my past shutdown reasons and comments and what is the ...
0
votes
1
answer
6k
views
How to get the domain controller time sync event?
My computer is part of the domain. Say I manually adjust the clock to be off by 2min.
Domain controller will sync this clock with its own at some point.
Is it possible to track domain controller time ...
2
votes
3
answers
11k
views
Error5: Access is denied while restarting Event Log service
I am trying to restart windows event log service but i get this error
Windows could not stop the windows event log service on local computer.
Error5: Access is deined
My OS is Windows 7 (64) ...
6
votes
3
answers
2k
views
Blank screen in Windows 8.1
Recently I bought new computer (AMD FX-6300, 8GB RAM, SSD and GTX650 as graphic card). I installed Windows 8.1. At the beginning everything went well. But after one day I have two strange problems.
1)...
13
votes
2
answers
23k
views
Why is the "Task category" drop down to filter a Windows event log disabled?
I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?...
0
votes
1
answer
692
views
how do I check, how many times printing command is run on my windows
I have to check for a specific time range, how many times the printing command is executed on my PC/Windows….
Is Operating system make any log of printing commands...? If yes How and where i found it....