The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

learn more… | top users | synonyms

3
votes
3answers
11k views

Is it possible to access the Windows event log if the system is unbootable?

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?
0
votes
1answer
12 views

Clear Application Event Log by Source

I've seen various sources suggesting something like this to clear all event logs: wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"} But what I would like to do is remove ...
0
votes
1answer
36 views

Windows 10 Kernel-Power 41 error after go to sleep

I have a recurring problem with my ASUS G56JR notebook under Windows 10, somehow the the system crashes after to go sleep. When I awake it, the eventlog shows the following: I read a guys problem ...
1
vote
1answer
333 views

Windows 10 ShellExperienceHost crashes

I recently cloned my Windows 10 partition from HDD to SSD. I cannot open the Start Menu, Notifications, or anything that uses ShellExperienceHost. This includes things like the Calculator app, Edge ...
2
votes
1answer
4k views

What is SRUJet?

I see in Event log many error entries : svchost (1500) SRUJet: An attempt to open the file "C:\Windows\system32\SRU\SRUDB.dat" for read / write access failed with system error 5 ...
2
votes
1answer
6k views

A series of DeviceSetupManager warnings in Windows 10 event logs

I have been "cleaning up" Windows 10, and I'm noticing a series of warnings in the Event Viewer every time I start Windows. And they are in the following order. Event 202, DeviceSetupManager "The ...
0
votes
1answer
38 views

How to Reboot and shut down based on Windows Update Status

I am working on Schedule Tasks where I can reboot or shutdown my OS based on Windows Update status. My Setup Run this task weekly on login. This task starts wuauclt.exe /detectnow /updatenow. Then ...
0
votes
1answer
50 views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
0
votes
0answers
6 views

sp_send_dbmail spamming Event Log

I have some unknown but work-relevant process on my development computer executing every 10 seconds. It calls a stored procedure in SQL Server. Part of this stored procedure is to call ...
15
votes
3answers
49k views

Upgrade to Windows 10 Pro, version 1511, 10586 errors with 0x8024200D

I have seen a few people with this problem on forums, but nobody seems to have a solution yet. Windows says I should restart because I have an update pending (this is 10586). During restart there is ...
0
votes
1answer
32 views

Modifying script to capture login/shutdown times in Windows

For some time now I've been using this script to view my login time for a particular computer: Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFile = ...
0
votes
2answers
101 views

Windows Network resource access audit

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files) Is there a simple way to have such operations logged?
0
votes
1answer
2k views

Windows 7 Security Auditing being turned off - By what?

This has been driving me nuts. I've searched high and low for a solution but have found nothing. I did find this question which I thought held the solution through auditpol.exe. No dice. I can set my ...
0
votes
0answers
633 views

Get delete events with file name and user for particular folder

In my windows server 2012 i want to know which files is deleted from a folder by which network user. I want to track delete events only for particular folder. I have done it using group policy and ...
0
votes
0answers
64 views

Error roaming credentials in Windows 10

I recently started getting a series of strange events in Windows 10. There was an error while applying setting unit 879C846CFF67B4C6D3D70C6698FF11D468BBE789 for roaming collection ...
3
votes
1answer
1k views

Identifying Windows 10 \Device\Harddisk1\DR2

I'm getting errors in Windows 10's event log stating \Device\Harddisk1\DR2 drive controller is having a problem. I know that the hard disk numbers depend on the BIOS and do not match the physical ...
1
vote
1answer
27 views

Are there negative consequences to disabling audit policies?

I'm the sole user of my own laptop running Windows 8.1. After doing a bit of research into this (eg. SuperUser question and Microsoft Technet), I can see how this might be useful for a company laptop. ...
0
votes
1answer
3k views

Forward Windows system Event logs to a Linux Syslog Server with no agent

We have a SCOM 2012 server. We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features. We also have a ...
0
votes
0answers
58 views

File delete audit, Windows 8

I have a shared folder (folderA) and our users must copy some files everyday and after they finish working they have to delete files and when they delete files there must be a record.(for security ...
0
votes
0answers
97 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
0
votes
0answers
19 views

Keeping track of files across two drives

At work, there is a 450GB network drive (X:) which has served as a dumping-ground for 3 of my underfunded NGO's biggest departments. It needs to be reorganized. Depending on a manager's opinion, a ...
0
votes
0answers
13 views

Audit logon events with password

I configured my server so it would show audit logon events in case of Failure. Now I want to also record password. Somebody is trying to hack my server. In the event log I only see username which the ...
8
votes
2answers
5k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
2
votes
0answers
60 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
3
votes
1answer
996 views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
3
votes
2answers
8k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
5
votes
1answer
2k views

Windows Security Log and Audit Failures

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen ...
0
votes
0answers
85 views

How to Grant Write Access to Windows Server 2012 R2 Application Event Log

I'm running Windows Server 2012 R2 and under that I'm running VMWare Workstation Pro. When Workstation is installed, the user Group __vmware__ is created for VMWare Workstation users. I've added my ...
0
votes
0answers
1k views

Windows 10 constant graphics driver crashing for no apparent reason

I recently bought asus gtx 750 oc card, installed it with its driver on windows 7 and it worked fine. Indidntnuse it too long but longer than I could run it on windows 10 without a problem. ...
0
votes
1answer
24 views

How can I find out when I logged in without administrator access?

How can I find out when I logged in without administrator access on Win 7? It doesn't let me open the Security Log in Event Viewer. Is there another way to find this out?
0
votes
1answer
696 views

Event ID: 7016 LitModeCtrl service has reported an invalid current state 32

I am getting all the time the below error in Windows Event Viewer. Throughout the web a lot of people get this error but there are no solutions to it. I was getting the error when i was using Windows ...
1
vote
0answers
51 views

VeraCrypt + CLI + /password + turned off log?

VeraCrypt can be managed by CLI and bash/batch scripts on Linux/Windows respectively. However, IDRIX emphasizes that command containing password [flag /p, /password (Windows) or --password (Linux)] ...
2
votes
1answer
12k views

Open / Read .evt Files From Another Computer

I'd like to open and read Windows Event Log files. The files will be copied from a non-functioning install of Windows XP SP3 and I'd like to read them from a totally different install of Windows XP ...
0
votes
2answers
373 views

Lenovo Power Dial Software causing Errors

I am using Windows 7 Professional 64 Bit Lenovo IdeaCentre K330. Recently i checked my Windows Event Viewer and i see that I have got a lot of the following error's: SideBySide Event ID: 33 ...
1
vote
1answer
73 views

What event log should I check for Hardware Changes

Approximately every 10 seconds my PC seems to be adding new hardware then instantly removing it. For example, you know the sound when you insert a new USB device and it starts to look for drivers? It ...
2
votes
2answers
2k views

VMware Player flooding my event log with information events about “I120: Service being interrogated…”

Every few seconds a few entries of Information Event 1000 shows up in my event log saying vmauthd was the source. Here is the xml log of the event. all the others are identical other than a ...
1
vote
1answer
39 views

Show really all events from the Windows event log

I can make a custom filter for Windows event log to include really everything from all sources. But when I try to open it, it tells me the filter is too long (error 1734) and I cannot use it. I'm ...
0
votes
0answers
20 views

Show details on Windows and Ubuntu boot screens?

I want the boot screens (at 640x480 resolution) to show a scrolling list of startup events, along with: "per-event" and "total" progress bars, each with percentages and "number of drivers ...
0
votes
1answer
24 views

Does Windows log its tasks and events?

There is a computer in my network at work of which the settings somehow have changed. Either someone changed something or it changed by itself. Is there any log or event manager to have a look at what ...
1
vote
2answers
189 views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
7
votes
3answers
14k views

Does Windows log programs that have been run/called?

In Windows, is there a log that records what programs were run/called? While browsing the internet, viewing a static page with no ads, mouse clicks, keypresses, or miscellaneous ...
0
votes
0answers
23 views

Write to Windows Event Log from Linux

I have System Center Orchestrator setup to monitor a Windows Event Log for particular events and then run a runbook when they occur. It works well but I'd like to be able to feed in data from my ...
1
vote
1answer
126 views

How to log a shutdown caused from overheating or overheated components?

On a Windows 7 SP1 machine I would like to know how I could reliably log a shutdown that was caused exclusively from overheated components of the machine. Since the component that overheats must send ...
0
votes
0answers
18 views

View multiple Event Viewer logs From USB

I've copied the entire Windows event viewer log folder onto a USB, and I'm trying to view them in an Event Viewer on another PC, but I can only open one log at a time. Is there a way that I can open ...
0
votes
1answer
745 views

Recurring event in Event Log: “Windows Security Center Service could not stop Windows Defender”

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
0
votes
1answer
39 views

How to make wevtutil tool return results in UTF-8 format?

I'm writing a script that requires me to look up a specific event in the Windows Event Log using wevtutil tool. The command line goes as such: wevtutil qe System ...
0
votes
1answer
40 views

How to log executed batch files?

Let's say I executed 5 batch files yesterday and now I want to know the order of the execution of the files. Does Windows log the execution, maybe in Windows Event Logs or something? Or is there any ...
2
votes
1answer
131 views

Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events

I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
0
votes
1answer
73 views

How can I change the port of the Event Log on Windows 7

I have following problem. I have a Linux device connected to a PC over a USB with pipe that is configured as network device and is correctly recognized by Win7 in device manager. This Linux device ...
3
votes
3answers
16k views

Windows 7: Crashing after update - How to check Event Logs?

My desktop appears to be blue screening and restarting after Win7 hard drive installation. How can I navigate to event viewer in Win 7 and see when was the last time it crashed unexpectedly?