The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

learn more… | top users | synonyms

12
votes
3answers
65k views

How can I use Event Viewer to confirm login times filtered by User?

I'm required to log my start and finish times at work. Occasionally I forget to do this and had a bright idea that checking the Security events log would allow me to retrospectively ascertain my times....
4
votes
1answer
281 views

Are there events which show application launches and activity in Windows?

I would like to understand how my computer is being used. I could use something like ManicTime, but it seems like this information should also be in the event log somewhere. Is it? If not, is there ...
0
votes
0answers
4 views

How can you grant the ApplicationPoolIdentity access to write to the Application Event Log?

How can you grant the ApplicationPoolIdentity access to write to the Application Event Log?
2
votes
1answer
5k views

What is SRUJet?

I see in Event log many error entries : svchost (1500) SRUJet: An attempt to open the file "C:\Windows\system32\SRU\SRUDB.dat" for read / write access failed with system error 5 (0x00000005):...
2
votes
1answer
7k views

A series of DeviceSetupManager warnings in Windows 10 event logs

I have been "cleaning up" Windows 10, and I'm noticing a series of warnings in the Event Viewer every time I start Windows. And they are in the following order. Event 202, DeviceSetupManager "The ...
6
votes
1answer
3k views

Audit failure 5061 after logging in to Windows 10

Logging in to Windows 10 Build 10547 I see for a split second a message box pop up. There's no time to read it as the login succeeds. In the event log I see: Audit failure 5061 with a task ...
0
votes
2answers
49 views

Why did my Windows 10 restarted?

I did run my overnight computations and when I came to my computer, it is restarted :-( I would like to find reason why, if it was due to my computation process crashing or some system update. I have ...
1
vote
0answers
22 views

Server Unexpected Shutdown

If you have a Windows server that has an Unexpected Shutdown and there is nothing in the logs (no power failure, critical events or hardware failures), and no memory dump for blue screen then is the ...
0
votes
0answers
12 views

Is there a log in Windows 8.1 which would say when the monitor resolution was changed?

I logged into my computer remotely and have noticed that my screen orientations have changed and I'm missing a monitor. I'd like to take a look at the logs and see when (and maybe how) this occurred. ...
0
votes
0answers
26 views

External Hard Drive Problems in Event Viewer

I'm using a Western Digital My Passport Ultra (2TB) 1.5 years ago and I've recently been seeing a lot of problems with this external drive in event viewer. So far, whenever I connect this to the ...
1
vote
1answer
148 views

VeraCrypt + CLI + /password + turned off log?

VeraCrypt can be managed by CLI and bash/batch scripts on Linux/Windows respectively. However, IDRIX emphasizes that command containing password [flag /p, /password (Windows) or --password (Linux)] ...
0
votes
0answers
71 views

Solving Windows 10 “Activation permission for the COM Server application”

On a clean genuine Windows 10 installation, the Event Viewer throws one of these errors every 2-5 minutes: The application-specific permission settings do not grant Local Activation permission ...
2
votes
1answer
35 views

Windows 7 64b - Where did my password vanish to? When did it go poof?

Ok, here's the situation. Update: I have solved the situation My machine is set to log me in automatically after startup, then lock the workstation with a registry entry. If you must know, the ...
3
votes
3answers
12k views

Is it possible to access the Windows event log if the system is unbootable?

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?
0
votes
1answer
16 views

Clear Application Event Log by Source

I've seen various sources suggesting something like this to clear all event logs: wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"} But what I would like to do is remove ...
0
votes
1answer
125 views

Windows 10 Kernel-Power 41 error after go to sleep

I have a recurring problem with my ASUS G56JR notebook under Windows 10, somehow the the system crashes after to go sleep. When I awake it, the eventlog shows the following: I read a guys problem ...
1
vote
1answer
1k views

Windows 10 ShellExperienceHost crashes

I recently cloned my Windows 10 partition from HDD to SSD. I cannot open the Start Menu, Notifications, or anything that uses ShellExperienceHost. This includes things like the Calculator app, Edge ...
0
votes
1answer
59 views

How to Reboot and shut down based on Windows Update Status

I am working on Schedule Tasks where I can reboot or shutdown my OS based on Windows Update status. My Setup Run this task weekly on login. This task starts wuauclt.exe /detectnow /updatenow. Then ...
0
votes
1answer
73 views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
0
votes
0answers
10 views

sp_send_dbmail spamming Event Log

I have some unknown but work-relevant process on my development computer executing every 10 seconds. It calls a stored procedure in SQL Server. Part of this stored procedure is to call ...
18
votes
3answers
56k views

Upgrade to Windows 10 Pro, version 1511, 10586 errors with 0x8024200D

I have seen a few people with this problem on forums, but nobody seems to have a solution yet. Windows says I should restart because I have an update pending (this is 10586). During restart there is ...
0
votes
1answer
38 views

Modifying script to capture login/shutdown times in Windows

For some time now I've been using this script to view my login time for a particular computer: Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFile = objFSO.GetFile("C:\Windows\...
0
votes
2answers
102 views

Windows Network resource access audit

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files) Is there a simple way to have such operations logged?
0
votes
1answer
2k views

Windows 7 Security Auditing being turned off - By what?

This has been driving me nuts. I've searched high and low for a solution but have found nothing. I did find this question which I thought held the solution through auditpol.exe. No dice. I can set my ...
0
votes
0answers
778 views

Get delete events with file name and user for particular folder

In my windows server 2012 i want to know which files is deleted from a folder by which network user. I want to track delete events only for particular folder. I have done it using group policy and ...
0
votes
0answers
131 views

Error roaming credentials in Windows 10

I recently started getting a series of strange events in Windows 10. There was an error while applying setting unit 879C846CFF67B4C6D3D70C6698FF11D468BBE789 for roaming collection Windows-Credentials....
3
votes
1answer
3k views

Identifying Windows 10 \Device\Harddisk1\DR2

I'm getting errors in Windows 10's event log stating \Device\Harddisk1\DR2 drive controller is having a problem. I know that the hard disk numbers depend on the BIOS and do not match the physical ...
1
vote
1answer
27 views

Are there negative consequences to disabling audit policies?

I'm the sole user of my own laptop running Windows 8.1. After doing a bit of research into this (eg. SuperUser question and Microsoft Technet), I can see how this might be useful for a company laptop. ...
0
votes
1answer
3k views

Forward Windows system Event logs to a Linux Syslog Server with no agent

We have a SCOM 2012 server. We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features. We also have a centralized ...
0
votes
0answers
68 views

File delete audit, Windows 8

I have a shared folder (folderA) and our users must copy some files everyday and after they finish working they have to delete files and when they delete files there must be a record.(for security ...
0
votes
0answers
107 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
0
votes
0answers
24 views

Keeping track of files across two drives

At work, there is a 450GB network drive (X:) which has served as a dumping-ground for 3 of my underfunded NGO's biggest departments. It needs to be reorganized. Depending on a manager's opinion, a ...
0
votes
0answers
13 views

Audit logon events with password

I configured my server so it would show audit logon events in case of Failure. Now I want to also record password. Somebody is trying to hack my server. In the event log I only see username which the ...
8
votes
2answers
6k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
2
votes
0answers
63 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
3
votes
1answer
1k views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
3
votes
2answers
8k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
5
votes
1answer
2k views

Windows Security Log and Audit Failures

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen ...
0
votes
0answers
198 views

How to Grant Write Access to Windows Server 2012 R2 Application Event Log

I'm running Windows Server 2012 R2 and under that I'm running VMWare Workstation Pro. When Workstation is installed, the user Group __vmware__ is created for VMWare Workstation users. I've added my ...
0
votes
0answers
1k views

Windows 10 constant graphics driver crashing for no apparent reason

I recently bought asus gtx 750 oc card, installed it with its driver on windows 7 and it worked fine. Indidntnuse it too long but longer than I could run it on windows 10 without a problem. http://m....
0
votes
1answer
24 views

How can I find out when I logged in without administrator access?

How can I find out when I logged in without administrator access on Win 7? It doesn't let me open the Security Log in Event Viewer. Is there another way to find this out?
0
votes
1answer
726 views

Event ID: 7016 LitModeCtrl service has reported an invalid current state 32

I am getting all the time the below error in Windows Event Viewer. Throughout the web a lot of people get this error but there are no solutions to it. I was getting the error when i was using Windows ...
2
votes
1answer
12k views

Open / Read .evt Files From Another Computer

I'd like to open and read Windows Event Log files. The files will be copied from a non-functioning install of Windows XP SP3 and I'd like to read them from a totally different install of Windows XP ...
0
votes
2answers
383 views

Lenovo Power Dial Software causing Errors

I am using Windows 7 Professional 64 Bit Lenovo IdeaCentre K330. Recently i checked my Windows Event Viewer and i see that I have got a lot of the following error's: SideBySide Event ID: 33 ...
2
votes
1answer
134 views

What event log should I check for Hardware Changes

Approximately every 10 seconds my PC seems to be adding new hardware then instantly removing it. For example, you know the sound when you insert a new USB device and it starts to look for drivers? It ...
2
votes
2answers
3k views

VMware Player flooding my event log with information events about “I120: Service being interrogated…”

Every few seconds a few entries of Information Event 1000 shows up in my event log saying vmauthd was the source. Here is the xml log of the event. all the others are identical other than a ...
1
vote
1answer
61 views

Show really all events from the Windows event log

I can make a custom filter for Windows event log to include really everything from all sources. But when I try to open it, it tells me the filter is too long (error 1734) and I cannot use it. I'm ...
0
votes
0answers
20 views

Show details on Windows and Ubuntu boot screens?

I want the boot screens (at 640x480 resolution) to show a scrolling list of startup events, along with: "per-event" and "total" progress bars, each with percentages and "number of drivers loaded/...
0
votes
1answer
25 views

Does Windows log its tasks and events?

There is a computer in my network at work of which the settings somehow have changed. Either someone changed something or it changed by itself. Is there any log or event manager to have a look at what ...
1
vote
2answers
242 views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...