The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

learn more… | top users | synonyms

-1
votes
0answers
22 views

Why do I have all these events in my Windows security log?

I just checked the Event Log, and I've got tons of these "Logon" and "Special Logon" events, occuring every 5-15 minutes: They all seem to be the same. This is a Logon: Log Name: Security ...
1
vote
1answer
54 views

Mysterious event log message

I saw this message in my event log today. I tried searching on it without much success. - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider ...
0
votes
2answers
52 views

Event log Clear options in windows 2003

What are the different options to clear Event logs in windows 2003 other than opening event viewer and clearing logs one by one interactively? I don't consider powershell is an option as this also ...
0
votes
1answer
39 views

Windows security log shows mysterious user logins

In troubleshooting an unrelated problem, I noticed that one user's (Jeny) Windows security log showed several logins and logoffs from another user (Holly). Holly confirms that she logged into her ...
0
votes
1answer
41 views

ID disk from event message

I have the following event in event viewer: "The driver detected a controller error on \Device\Harddisk6\DR19." Log Name: System Source: Disk EventID: 11 Level: Error How do I know what disk this ...
2
votes
1answer
6k views

Deleting Event Logs - Windows Server 2003

Can someone tell me how to delete Event Logs on Windows Server 2003? I have a number of application logs in the Event Viewer - how can these be removed? I've tried disabling the Event Log service on ...
7
votes
1answer
1k views

Did my computer unlock itself?

I woke up around noon to find my computer unlocked, despite having remembered locking it the previous night and not using it since. I checked the security log, and saw a "logon" event from 11:16 AM. ...
1
vote
1answer
26 views

How to target an event by the process name as well as the ID?

I have managed to create a scheduled task that will be triggered by an event ID. For example, I have a task that will run winver.exe whenever event ID 4688 is logged. So if I run notepad.exe from Run ...
0
votes
0answers
16 views

security log events management in windows 2003

Login, Clear Logs and log off events in Windows 2003 when does this happen and what are the IDs for these events ? what is the system login? In an event when administrator account and password are ...
0
votes
0answers
37 views

Windows 8.1 freezes due to video card and usually recovers

I have a couple of Radeon video cards (hd6450, hd6670) on win 8.1. Occasionally the screens will go blank and I get a message about recovering from a video card problem. Usually the recovery is ...
1
vote
0answers
110 views

Windows Event Forwarding between two computer out of a domain

I've got two computers and I want to set up event forwarding between them. Source computer is out of a domain, another is in some Domain. I tried to configure source initiated event subscrption but it ...
0
votes
0answers
23 views

EventLog Source “Connect”. No events in EventLog

I'm baffled by this, as I can find no documentation on wether or not "Connect" or "Connection" is some kind of registered keyword for EventLog Sources. I'm trying to create an EventLog Source called ...
0
votes
0answers
18 views

Microsoft-Windows-UAC-FileVirtualization error logged

I installed nxlog on my MS Windows 8.1 to remotely log the computer activity and discovered an error: Feb 08 17:31:28 samsung Microsoft-Windows-UAC-FileVirtualization: Accès refusé à la suppression ...
0
votes
0answers
26 views

How to find uninstalled software lists and logs in Windows?

I am using a Lenovo laptop with Windows 8.1. Yesterday I ran Lenovo Solution Center software. It gave me some details about the software which I have used in past and currently not installed in my ...
0
votes
0answers
51 views

How to find what is causing a Kernel EventTracing error in the Event Log?

I am troubleshooting a Kernel EventTracing "session failed to start with the following error: 0xc0000011" that pops up too many times in my event log. Every solutions I found in google were very ...
0
votes
1answer
29 views

View users login activity

Is there a way from the local event logs of a windows 7 computer to tell when the users logged into the cpu?- I see logon 4624 / logoff 4634 But those seem to be every 30min or so not tied to users ...
0
votes
1answer
23 views

Does Windows log when a user attempts to execute an application that is not on the whitelist?

I have searched Google with several search terms, attempting to discover if Windows logs when a user attempts to run an application that is not whitelisted, and if so, in what event log. Can anyone ...
0
votes
0answers
214 views

Recurring event in Event Log: “Windows Security Center Service could not stop Windows Defender”

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
0
votes
0answers
13 views

Event Logs and Events That Are Replicated

I'm trying to understand how certain events are represented in the event logs of the domain controllers. Specifically about how events occurring on one DC are replicated to other DCs. Let's say I ...
1
vote
0answers
18 views

Analysis to extract task flows from UI event log

Given a table of UI events, how can I detect task flows, task loops, and behavioural patterns? I'm instrumenting my software to track what the user does. Controls clicked, keys pressed, and so on, ...
0
votes
1answer
47 views

Is there a trace of users killing a process on windows machine

We're debugging a situation in a retail location where the program does a bunch of logging but then everything just stops. it's pretty apparent that the comm to an external web service is taking some ...
0
votes
1answer
25 views

how do I check, how many times printing command is run on my windows

I have to check for a specific time range, how many times the printing command is executed on my PC/Windows…. Is Operating system make any log of printing commands...? If yes How and where i found ...
1
vote
1answer
159 views

Windows 7 OK button on Copy To dialog doesn't copy profile

So I am attempting to copy a User Profile to the default profile. I am using WinSpy++ to enable the disabled "Copy To" button - this process works on a stock laptop I have here. However, this does ...
1
vote
1answer
57 views

Accessing Server 2008 R2 manual shutdown notes and event logs

When I manually reboot a server I am required to specify a reason for the restart and given the opportunity to provide a comment. How do I review my past shutdown reasons and comments and what is the ...
0
votes
1answer
57 views

How to get the domain controller time sync event?

My computer is part of the domain. Say I manually adjust the clock to be off by 2min. Domain controller will sync this clock with its own at some point. Is it possible to track domain controller time ...
9
votes
4answers
11k views

Starting scheduled task by detecting connection of USB device

I know it has been discussed that it is not possible to start an application from an usb drive upon connection due to limitations of autorun (or autoplay??) in Win 7. But it is possible to create a ...
6
votes
3answers
269 views

Blank screen in Windows 8.1

Recently I bought new computer (AMD FX-6300, 8GB RAM, SSD and GTX650 as graphic card). I installed Windows 8.1. At the beginning everything went well. But after one day I have two strange problems. ...
0
votes
1answer
271 views

Why is the “Task category” drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use ...
1
vote
0answers
223 views

Windows 8 crashing unexpectedly

The computer I use at work sometimes crashes when I'm not near it. The first time it happened the OS crashed dead (even the mouse cursor wasn't moving). At that time I couldn't get much information ...
0
votes
0answers
610 views

Acer Aspire Timeline Ultra M3-581TG Laptop. It turned off automatically without warning

I have a laptop : Acer Aspire Timeline Ultra M3-581TG Laptop, using Windows 7 Home Premium 64 bit, 4GB RAM, Core i5 It turned off automatically without warning. There was no shutdown procedure, ...
0
votes
1answer
52 views

How to identify drive device from log?

I have a messages about drive errors in log, like this: Bad Block On Device \Device\Harddisk0\DR0 I have 2 harrdrives in the system. How to know, which one causes these errors? I see nowhere the ...
6
votes
2answers
332 views

How can I determine who is connected to event log remotely?

Is there a way to figure out which user and/or which computer is remotely accessing my computer's Windows event log files? These accesses are locking applications on the local computer and thereby ...
1
vote
2answers
7k views

Very infrequent Excel crash

Have 1 user who keeps experiencing an Excel crash when sorting data. It is very infrequent and as of yet i've not done any serious troubleshooting, just an Office repair. Event log reports the ...
1
vote
1answer
64 views

How to capture a windows pop-up box event in task manager or by other method?

The pop-up box event is a windows error notification with a 'OK' click box. I want to auto-click the 'OK' or suppress the appearance of the pop-up box. But how to capture this event? I can't see ...
-1
votes
0answers
69 views

Event log error player.SoundLocation() failed [duplicate]

Possible Duplicate: The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer We have a client machine 'secon' ...
4
votes
1answer
193 views

Are there events which show application launches and activity in Windows?

I would like to understand how my computer is being used. I could use something like ManicTime, but it seems like this information should also be in the event log somewhere. Is it? If not, is there ...
0
votes
1answer
148 views

How do I register an event log so that psloglist can access it?

This post is about the new sysmon tool from Sysinternals/Microsoft and the event log as relates to psloglist.exe, also from Sysinternals/Microsoft I'd like to query the sysmon windows event log: ...
1
vote
0answers
756 views

What is SRUJet?

I see in Event log many error entries : svchost (1500) SRUJet: An attempt to open the file "C:\Windows\system32\SRU\SRUDB.dat" for read / write access failed with system error 5 ...
0
votes
0answers
14 views

Alert when the Windows EventLog service is turned off

Is there anyway of getting an email/alert when the Windows EventLog service is turned off/stops? OR Is there a log entry create when this happens that can be tracked?
0
votes
0answers
59 views

OSSEC threat detection to monitor Windows Services

Is it possible to use OSSEC threat detection software to monitor Microsoft Windows Services, and notify you when a service has been turned off? In particular monitoring if the Logging Services have ...
0
votes
0answers
38 views

Connection of Session ids of Scheduled Task and remote desktop connection in event log

A scheduled process using powershell script was set up as ONE TIME process to clear the Event Log events (windows 2003). However, this process ran at a time when another user was logged in remotely ...
0
votes
0answers
473 views

What's the equivalent of Wevtutil in XP or 2003?

I have a batch file for saving event logs to our shared drive. I want to do this for XP and Server 2003 without very much effort. What could I use since Wevtutil is only on Vista and up? rem Script ...
3
votes
0answers
60 views

How does Windows 7 determine that a system was not shut down correctly (Kernel-Power Event ID 41) [duplicate]

I have a strange situation that Windows 7 thinks it was not shut down correctly, and gives me a warning in the system event log like this: http://support.microsoft.com/kb/2028504/de What the ...
3
votes
3answers
1k views

Is there a way to measure an employee's computer usage?

I have been asked to see if a user is being productive. Windows 7 doesnt log much in the way of computer usage, but I was thinking it would be possible to see how long the computer is in a locked ...
1
vote
0answers
122 views

XPath event filter working in Event Viewer but not in Task Scheduler

I'm trying to trigger a scheduled task with this XML: <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='TargetInfo']='S']] ...
0
votes
0answers
59 views

Slow startup due to event log

My computer takes roughly 10-15 minutes to startup. I found that if I disable Windows Event Log in msconfig that startup is normal again. This is on windows 7. I am guessing that the event log is ...
0
votes
0answers
154 views

Sudden change of username & password prompt from UAC?

I just recently noticed that my username changed from "Dani" to "daniel" (It's a computer I recently got and haven't gotten around to changing its name.). The name of the PC is still the same ...
3
votes
1answer
6k views

Is it possible to access the Windows event log if the system is unbootable?

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?
0
votes
1answer
504 views

Is it possible to force users to change password periodically in Windows 8.1 Pro and how?

According to the one of the security requirements enforced upon our office, we must start to control / enforce passwords are changed every now and then. Is there a way to force users to change their ...
2
votes
1answer
466 views

Process Monitor capture filter (or scripting)

As you know, Microsoft distributes the Russinovich extremely powerful process monitor. It captures a lot of system events and has a filter to show only some of them. I want to record a rare fault at ...