Questions tagged [event-log]

The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

Filter by
Sorted by
Tagged with
23 votes
6 answers
283k views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
cpx's user avatar
  • 1,395
1 vote
1 answer
23k views

How to log a shutdown caused from overheating or overheated components?

On a Windows 7 SP1 machine, I would like to know how I could reliably log a shutdown that was caused exclusively from overheated components of the machine. Since the component that overheats must ...
lowtechsun's user avatar
0 votes
1 answer
876 views

How to make wevtutil tool return results in UTF-8 format?

I'm writing a script that requires me to look up a specific event in the Windows Event Log using wevtutil tool. The command line goes as such: wevtutil qe System /q:"*[System[Provider[@Name='...
c00000fd's user avatar
  • 547
1 vote
1 answer
2k views

How to log executed batch files?

Let's say I executed 5 batch files yesterday and now I want to know the order of the execution of the files. Does Windows log the execution, maybe in Windows Event Logs or something? Or is there any ...
Altiano Gerung's user avatar
1 vote
1 answer
106 views

Are there negative consequences to disabling audit policies?

I'm the sole user of my own laptop running Windows 8.1. After doing a bit of research into this (eg. SuperUser question and Microsoft Technet), I can see how this might be useful for a company laptop. ...
AlainD's user avatar
  • 4,675
0 votes
1 answer
1k views

How can I change the port of the Event Log on Windows 7

I have following problem. I have a Linux device connected to a PC over a USB with pipe that is configured as network device and is correctly recognized by Win7 in device manager. This Linux device ...
panako's user avatar
  • 101
1 vote
2 answers
5k views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
CarlosLeo's user avatar
0 votes
1 answer
50 views

Tracing storage media ejects and disconnects

I had a SD card that I kept permanently plugged into my laptop. Had, until I noticed it was missing this week. I don't know when exactly it fell out, the laptop may or may not have been in suspend at ...
Daniel Sk's user avatar
  • 101
21 votes
3 answers
71k views

Upgrade to Windows 10 Pro, version 1511, 10586 errors with 0x8024200D

I have seen a few people with this problem on forums, but nobody seems to have a solution yet. Windows says I should restart because I have an update pending (this is 10586). During restart there is ...
Brook's user avatar
  • 433
2 votes
0 answers
2k views

If ESENT complains that it cannot create its logfile, is it avoidable?

In my installation of Windows 10 on a fairly new machine that shipped with it, I get a lot of errors in my eventvwr log, and some of them I feel are indicative of why my system hits 100% disk use for ...
dlamblin's user avatar
  • 10.7k
0 votes
2 answers
809 views

Windows 7 Home Premium: Event ID 4624: Someone logged in when I was away

I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following: 28/10/2015 14:54:25 Event ID 4624 (access type: 2) 28/10/...
Jordan Jamingsons's user avatar
2 votes
1 answer
3k views

Difference between Windows events 4801 and 4624

(for background, see: In Windows 7, How to query times, when the computer was locked?) It seems that there are two entirely separate events that may be generated in the windows event log when a ...
Jules's user avatar
  • 441
2 votes
1 answer
671 views

Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events

I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
Jordan Jamingsons's user avatar
1 vote
1 answer
733 views

How can I see which programs were ran by the user?

Programs & Features (or even better Nirsoft's MyUninstaller) tell me the program installed, and I can accessed some cached installation data, but is there a way to get a log of the executables ...
Jonny's user avatar
  • 23
1 vote
1 answer
6k views

Why are there so many unexpected shutdowns in the event log?

I was looking through my shutdown history in the event log today when I noticed that there was an "Unexpected Shutdown" (event ID 6008) logged way more often than I can ever recall there being ...
Josh's user avatar
  • 13
5 votes
2 answers
12k views

Disable windows powershell event logging

I'm using PsExec to run PowerShell scripts on remote machines and as a side effect of this, the "Windows PowerShell" event-log (found in the Event Viewer under "Applications and Services Logs") is ...
Bob P's user avatar
  • 51
8 votes
1 answer
11k views

Audit failure 5061 after logging in to Windows 10

Logging in to Windows 10 Build 10547 I see for a split second a message box pop up. There's no time to read it as the login succeeds. In the event log I see: Audit failure 5061 with a task ...
hellyale's user avatar
  • 143
0 votes
1 answer
1k views

see all logins and attempts in windows 7

There any way to get the dates and times of logins on a computer with windows 7 (Local and Remote) I read this article, but in events viewer I cant see any login (All events are other types) We ...
jasilva's user avatar
  • 105
1 vote
0 answers
83 views

Windows 8 Boot Reason

My friend asked me to troubleshoot an issue where his Windows 8.1 desktop would boot up automatically roughly 24 hours after previous shutdown. I'm really sceptical about it but the Event Viewer log ...
fleetC0m's user avatar
0 votes
0 answers
853 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
VenomFangs's user avatar
3 votes
1 answer
1k views

How do I Defrag/Optimize a Windows 8.1 Volume which has no Drive Letter? Does it matter?

I have a Dell Inspiron Ultrabook running Windows 8.1 (64-bit). In File Explorer, I click on Drive C Properties -> Tools -> Optimize. There I see 4 drives listed as follows: OS (C:) -- OK (0% ...
Tom-T's user avatar
  • 43
0 votes
1 answer
47 views

How do I log file writes to a directory on Windows Server 2003?

I handle some network administration for a small business. Recently, I discovered a set of windows backup files in a directory that was being regularly added to (multiple times daily) on our backup ...
Zach L's user avatar
  • 212
0 votes
0 answers
3k views

Windows 10 constant graphics driver crashing for no apparent reason

I recently bought asus gtx 750 oc card, installed it with its driver on windows 7 and it worked fine. Indidntnuse it too long but longer than I could run it on windows 10 without a problem. http://m....
pingu2k4's user avatar
  • 183
1 vote
1 answer
38 views

USB Event Log when computer powered down

I had a GoPro stolen from my computer at my work desk last night (I'm assuming). The GoPro was connected to one of my USB ports, and I was wondering if Windows tracked that information somehow? I have ...
Connor Hutchens's user avatar
2 votes
1 answer
19k views

A series of DeviceSetupManager warnings in Windows 10 event logs

I have been "cleaning up" Windows 10, and I'm noticing a series of warnings in the Event Viewer every time I start Windows. And they are in the following order. Event 202, DeviceSetupManager "The ...
Skipher's user avatar
  • 325
3 votes
3 answers
7k views

Windows 7 losing network connection randomly when other PC's are connected

I'm having quite an annoying problem which I haven't been able to find a solution for yet. I hope you can help me. When my PC was using my home network and was connected to the internet through a ...
Ghost's user avatar
  • 131
0 votes
1 answer
1k views

Determining Cause of Unexpected Shutdown on Windows 8.1

I left my computer unattended a little over half an hour while it was compressing some files. I came back, and my computer had apparently shut off. I looked at the Event Logs, and it told me that The ...
Andrew Tapia's user avatar
2 votes
1 answer
134 views

How can I receive e-mails based on certain Windows Firewall events?

Is it possible to receive an e-mail when Windows Firewall logs certain events (such as an inbound connection being accepted for example)?
Karan's user avatar
  • 56.5k
1 vote
0 answers
216 views

File delete audit, Windows 8

I have a shared folder (folderA) and our users must copy some files everyday and after they finish working they have to delete files and when they delete files there must be a record.(for security ...
Murat's user avatar
  • 109
3 votes
1 answer
7k views

Many successful logon and logoff requests in Windows Event Viewer

I'm getting thousands of logon and logoff requests every day from the same computer in the local network. It seems the computer is connecting from a different port every time. What could be the cause ...
Howie's user avatar
  • 231
2 votes
1 answer
6k views

Equivalent of wevtutil in powershell?

wevtutil is a command in cmd for displaying Windows logs in different formats. What is the equivalent cmdlet in Powershell?
leeand00's user avatar
  • 22.4k
1 vote
1 answer
63 views

Searching for a GPO's Name in a Windows 7 Event Log?

Is there a way to search for a particular string (a GPO) in a Windows Event Log Message? Instead of searching for an Event ID or filtering by event type?
leeand00's user avatar
  • 22.4k
0 votes
1 answer
186 views

Get Notified of Errors in Windows Event Log

I wrote a powershell script to make a database dump that I plan on having run nightly with Windows Task Scheduler. It outputs to a log file so I can make sure everything is working, but I want to be ...
JaredL's user avatar
  • 461
2 votes
0 answers
853 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
user avatar
0 votes
0 answers
851 views

How To Read NFC event?

I have an external NFC reader connected via usb to a Windows-7, with the drivers installed. It seems to work, as when I place a NFC card on the reader its led changes from red to green and the PC ...
malarres's user avatar
  • 208
1 vote
1 answer
3k views

Windows security log shows mysterious user logins

In troubleshooting an unrelated problem, I noticed that one user's (Jeny) Windows security log showed several logins and logoffs from another user (Holly). Holly confirms that she logged into her ...
Theresa's user avatar
  • 13
1 vote
2 answers
3k views

ID disk from event message [duplicate]

I have the following event in Event Viewer: "The driver detected a controller error on \Device\Harddisk6\DR19." Log Name: System Source: Disk EventID: 11 Level: Error How do I know what disk this ...
Darryl Severn's user avatar
2 votes
2 answers
5k views

How to target an event by the process name as well as the ID?

I have managed to create a scheduled task that will be triggered by an event ID. For example, I have a task that will run winver.exe whenever event ID 4688 is logged. So if I run notepad.exe from Run ...
Samir's user avatar
  • 20.8k
1 vote
1 answer
1k views

Mysterious event log message

I saw this message in my event log today. I tried searching on it without much success. - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider ...
slashdottir's user avatar
0 votes
1 answer
179 views

View users login activity

Is there a way from the local event logs of a windows 7 computer to tell when the users logged into the cpu?- I see logon 4624 / logoff 4634 But those seem to be every 30min or so not tied to users ...
Crash893's user avatar
  • 1,552
0 votes
1 answer
2k views

Does Windows log when a user attempts to execute an application that is not on the whitelist?

I have searched Google with several search terms, attempting to discover if Windows logs when a user attempts to run an application that is not whitelisted, and if so, in what event log. Can anyone ...
Redblur's user avatar
  • 11
1 vote
1 answer
2k views

Recurring event in Event Log: "Windows Security Center Service could not stop Windows Defender"

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
TheRotag's user avatar
  • 179
1 vote
0 answers
63 views

Analysis to extract task flows from UI event log

Given a table of UI events, how can I detect task flows, task loops, and behavioural patterns? I'm instrumenting my software to track what the user does. Controls clicked, keys pressed, and so on, ...
Ashley G's user avatar
4 votes
1 answer
6k views

Is there a trace of users killing a process on windows machine

We're debugging a situation in a retail location where the program does a bunch of logging but then everything just stops. it's pretty apparent that the comm to an external web service is taking some ...
tntwyckoff's user avatar
1 vote
1 answer
639 views

Accessing Server 2008 R2 manual shutdown notes and event logs

When I manually reboot a server I am required to specify a reason for the restart and given the opportunity to provide a comment. How do I review my past shutdown reasons and comments and what is the ...
arch-abit's user avatar
  • 465
0 votes
1 answer
6k views

How to get the domain controller time sync event?

My computer is part of the domain. Say I manually adjust the clock to be off by 2min. Domain controller will sync this clock with its own at some point. Is it possible to track domain controller time ...
Kimi's user avatar
  • 111
2 votes
3 answers
11k views

Error5: Access is denied while restarting Event Log service

I am trying to restart windows event log service but i get this error Windows could not stop the windows event log service on local computer. Error5: Access is deined My OS is Windows 7 (64) ...
HBasiri's user avatar
  • 167
6 votes
3 answers
2k views

Blank screen in Windows 8.1

Recently I bought new computer (AMD FX-6300, 8GB RAM, SSD and GTX650 as graphic card). I installed Windows 8.1. At the beginning everything went well. But after one day I have two strange problems. 1)...
Jacek's user avatar
  • 245
13 votes
2 answers
23k views

Why is the "Task category" drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?...
kevinmicke's user avatar
0 votes
1 answer
692 views

how do I check, how many times printing command is run on my windows

I have to check for a specific time range, how many times the printing command is executed on my PC/Windows…. Is Operating system make any log of printing commands...? If yes How and where i found it....
M Zubair Shamshad's user avatar

1
4
5
6 7 8