Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.

learn more… | top users | synonyms

0
votes
0answers
22 views

Is there any way to know that partition size has been changed in Windows 7

We have a Windows 7 desktop and want to know that did anyone resize the partition recently. Is there any way to do that? Will there be any logs in Event Viewer? We try to find events in Event Viewer ...
1
vote
1answer
50 views

Event ID 153 and 129 for three month old SSD. Did I buy a faulty SSD?

in April this year I bought a new Samsung SSD 750 EVO 250GB, installed it on my desktop pc and made a fresh installation of Windows 10. However, since I got this SSD, Windows will randomly lock up on ...
0
votes
2answers
49 views

Why did my Windows 10 restarted?

I did run my overnight computations and when I came to my computer, it is restarted :-( I would like to find reason why, if it was due to my computation process crashing or some system update. I have ...
0
votes
0answers
6 views

Audit Power Settings change

I helped with a machine that was stopping whilst running many samples in automatic mode. We found that it was because the machine was going to sleep during production. The settings should be never for ...
0
votes
0answers
71 views

Solving Windows 10 “Activation permission for the COM Server application”

On a clean genuine Windows 10 installation, the Event Viewer throws one of these errors every 2-5 minutes: The application-specific permission settings do not grant Local Activation permission ...
1
vote
0answers
32 views

What is the source of Printer Status Events in Windows 10?

While looking at Event Viewer, if I send a file to Print, I can see various entries in the logs regarding spooling and cancelled jobs - all located in: Microsoft->Windows->PrintSystems But if ...
1
vote
3answers
46 views

Notepad++ regex not working

I am trying to use Notepad++ and regular expressions to remove all XML from Windows' events. My regular expression is as follows: Event Xml:(.|\n)+?Event>\n Example Windows events are as ...
0
votes
1answer
38 views

Modifying script to capture login/shutdown times in Windows

For some time now I've been using this script to view my login time for a particular computer: Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFile = objFSO.GetFile("C:\Windows\...
0
votes
0answers
41 views

XML Xpath for Windows event?

I'm trying to create an event filter based on the following event XML (an example), but I seemed to be missing something: <?xml version="1.0" encoding="utf-8" standalone="yes"?> <Events>&...
4
votes
2answers
829 views

Windows 10 Search, Cortana, and Edge crashing

I have a relatively new install of Win10 Enterprise (Bitlocker enabled - hardware encryption with Samsung EVO 850 500 GB SSD) on a Lenovo T450s laptop, and despite having not set it up much yet for ...
3
votes
1answer
3k views

Identifying Windows 10 \Device\Harddisk1\DR2

I'm getting errors in Windows 10's event log stating \Device\Harddisk1\DR2 drive controller is having a problem. I know that the hard disk numbers depend on the BIOS and do not match the physical ...
0
votes
0answers
13 views

How to start Windows Event Viewer in Application node filtered for a specific provider?

My goal is to start Windows Event Viewer from a command line, with the Application node already selected, showing only entries for my specific application, or provider? In other words, I need to ...
0
votes
1answer
74 views

Server automatically shuts down at night for no apparent reason

Since a couple of weeks, I find my Windows 2008 R2 Server down every morning. I have checked the battery and it is not the problem. I turn ON the machine and it works normally, until it shuts down on ...
0
votes
1answer
73 views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
1
vote
1answer
188 views

What do these errors in Event Viewer mean?

I have been getting a lot of Event ID 10 errors when starting up my Windows 7 Ultimate 64 Bit(SP1). Two errors (sources are WMI and Service Control Manager) are seen very often that on every start-up ...
0
votes
0answers
18 views

View multiple Event Viewer logs From USB

I've copied the entire Windows event viewer log folder onto a USB, and I'm trying to view them in an Event Viewer on another PC, but I can only open one log at a time. Is there a way that I can open ...
0
votes
2answers
2k views

Explorer crashing repeatedly in Win 10 Ver 1511: explorerframe.dll culprit?

Recently (within 3-4 days or so) my explorer has been crashing regularly but inconsistently (i.e. persistent attempts at viewing a particular folder will eventually work.) I checked the Windows Event ...
1
vote
2answers
242 views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
0
votes
0answers
25 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
0
votes
0answers
45 views

How to force Windows Error Events for educational purposes

I'm looking to show some colleagues how to use the Event Viewer in Windows and would like a way create some Error and Warning messages on a demo machine. I know I could throw some dodgy RAM in or ...
0
votes
1answer
31 views

How can I use Xpath in Event Viewer to filter on substrings of the values of attributes?

I am trying to define Windows Eventviewer views using Xpath xml queries. I am able to select on attributes if I match on the entire value; for example [EventData[Data[@Name="Image"] and (Data="C:\...
0
votes
1answer
599 views

Windows 7: What is the event ID for a lock event and how to tell if it is user-initiated or not?

The following eventvwr.exe event relates to a screen unlock event: Event ID 4624 (access type: 7) (screen unlock) Now I need to find the screen lock event, so I can compare the time between when I ...
0
votes
2answers
96 views

Windows 7 Home Premium: Event ID 4624: Someone logged in when I was away

I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following: 28/10/2015 14:54:25 Event ID 4624 (access type: 2) 28/10/...
2
votes
1answer
150 views

Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events

I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
0
votes
0answers
17 views

Two or more IDs in event viewer with filter on Windows XP

Is there a way to filter 2 or more ID events. In win 7 you can use ","(e.g. 6006,6005). On the other side in XP I can't use comma to separate IDs, "unexpected input" or error like that is popping up ...
0
votes
0answers
107 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
3
votes
1answer
125 views

find out time taken by individual group policy computer startup scripts

I wish to reduce the time taken by our computer group policy. How can I find out which scripts of which group policy are run when I boot a computer, and how much time they take each? And how do I find ...
0
votes
1answer
45 views

What is the event viewer and why do scammers send you to it?

I recently received a scam call in which they tried* to direct me to the event viewer, but I couldn't seem to find any reason that they would try to gain access to it. It does not appear to have any ...
2
votes
3answers
815 views

how to get Windows event logs in English though the default language is Spanish?

I want to analyze the windows event logs that is been getting generated from windows machines. The default language for windows is Spanish so it is generating the logs in Spanish but the tool which i'...
0
votes
1answer
2k views

Getting lots of Audit Failures in Event Viewer > Security on Windows Server 2008 R2

Over the past few days we have been getting loads of audit failures on the event viewer > security. I suspect they hackers trying to gain access to the server, but they fall into 2 types: One where ...
0
votes
0answers
24 views

How do I run or quit a program at a certain time with Event Viewer?

I'm using the program Tunebite to convert songs. I need to convert a lot of songs and then quit the program after all processing is complete. There's an option to shutdown after completion but not to ...
0
votes
1answer
175 views

Track RDP user session activity in windows 2003

The users are connected to windows 2003 server remotely through RDP. At times the users remain connected but inactive with their remote desktop session minimized on their desktop machine. How can ...
0
votes
1answer
99 views

Windows 7 - displaying a message if an event occurs

I'd like to get a message when event 7026 occurs. (7026 = driver failed to load) But I can't create a working task for this purpose. Creating a task on the event (In Event Viewer right click on ...
0
votes
0answers
239 views

How To Read NFC event?

I have an external NFC reader connected via usb to a Windows-7, with the drivers installed. It seems to work, as when I place a NFC card on the reader its led changes from red to green and the PC ...
0
votes
1answer
114 views

Windows Event Viewer: Access Denied while trying to view login and logoff events

I'm running a localized version of Windows 7. I've followed the following steps to view the dates and times for the login and logoff events carried out on my computer: Press WinKey + R. Type ...
0
votes
1answer
762 views

Recurring event in Event Log: “Windows Security Center Service could not stop Windows Defender”

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
1
vote
1answer
2k views

How to solve Windows 7 regular hangs after fresh install. Some diagnosis done but can't pin down

I am getting regular hangs on my windows 7 machine imedietly after installation and after updating drivers. The machine is a Dell XPS 15 (L521x). It happens approximately once every few minutes. ...
1
vote
1answer
3k views

Why is the “Task category” drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?...
1
vote
0answers
612 views

Windows 8 crashing unexpectedly

The computer I use at work sometimes crashes when I'm not near it. The first time it happened the OS crashed dead (even the mouse cursor wasn't moving). At that time I couldn't get much information ...
1
vote
0answers
238 views

Event Viewer snapin fails after a power outage

I was in the middle of opening a saved event log from another computer when our building was hit with a power outage, and my desktop is not protected. After recovering from the power outage, I get an ...
1
vote
1answer
251 views

How to capture a windows pop-up box event in task manager or by other method?

The pop-up box event is a windows error notification with a 'OK' click box. I want to auto-click the 'OK' or suppress the appearance of the pop-up box. But how to capture this event? I can't see ...
0
votes
2answers
46 views

Where Does One Find Logs of Pentesting Tools on Windows

I'm scanning my Windows 8 machine with Nmap and OpenVAS (from a different machine on my LAN and another one over WAN) and I'm looking for logs for the occurrence of such events in the Event Viewer but ...
0
votes
0answers
50 views

stopping of event-viewer services, and performing malacious activities

what will happen if i shutdown the windows event log services. I know it will stop event viewer. My question is will this activity be logged somewhere. if yes, then where?. and where will be the ...
3
votes
2answers
12k views

Event 4797 “An attempt was made to query the existence of a blank password for an account”

On my Windows 8.1 desktop, I see a lot of messages like this from lsass.exe in the Event Viewer's audit log: An attempt was made to query the existence of a blank password for an account. Subject: ...
0
votes
0answers
2k views

Tracking who deleted a folder in Windows Server

Recently there are several cases of missing or deleted files/folder from various shared folders, so we have turned on the audit policy for Delete Subfolders and Files. However there are more than 100 ...
0
votes
0answers
161 views

Event Viewer is not opening

When I double click into Event Viewer in Control Panel, nothing happens. Computer management does not open too. No any error messages displayed. If I run eventvwr from command line, also nothing ...
2
votes
1answer
102 views

Unable to filter events in event viewer

Unable to filter events in event viewer: appropriate controls are dimmed:
1
vote
1answer
174 views

Windows Event Viewer, how to create group of remote computers?

We have a file of type .msc on our computer in a domain, that when opened shows this view: However, I can find no way to edit the file to add more computers to the list. How are these files created ...
3
votes
1answer
11k views

volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C:

I have the following error appearing in Event Viewer several times per day: The shadow copies of volume C: were aborted because of an IO failure on volume C:. source: volsnap Nothing found in web ...
0
votes
1answer
89 views

Win8 Event Viewer

I recently followed the answer on this site "Uninstalled Programs History...". That opened several hours of experimentation with Event Viewer. My question; Why are there many installed programs (...