Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.

learn more… | top users | synonyms

0
votes
1answer
19 views

Server automatically shuts down at night for no apparent reason

Since a couple of weeks, I find my Windows 2008 R2 Server down every morning. I have checked the battery and it is not the problem. I turn ON the machine and it works normally, until it shuts down on ...
0
votes
0answers
18 views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
1
vote
1answer
31 views

What do these errors in Event Viewer mean?

I have been getting a lot of Event ID 10 errors when starting up my Windows 7 Ultimate 64 Bit(SP1). Two errors (sources are WMI and Service Control Manager) are seen very often that on every start-up ...
0
votes
0answers
12 views

View multiple Event Viewer logs From USB

I've copied the entire Windows event viewer log folder onto a USB, and I'm trying to view them in an Event Viewer on another PC, but I can only open one log at a time. Is there a way that I can open ...
0
votes
1answer
786 views

Explorer crashing repeatedly in Win 10 Ver 1511: explorerframe.dll culprit?

Recently (within 3-4 days or so) my explorer has been crashing regularly but inconsistently (i.e. persistent attempts at viewing a particular folder will eventually work.) I checked the Windows Event ...
1
vote
2answers
103 views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
0
votes
0answers
18 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
0
votes
0answers
11 views

How to force Windows Error Events for educational purposes

I'm looking to show some colleagues how to use the Event Viewer in Windows and would like a way create some Error and Warning messages on a demo machine. I know I could throw some dodgy RAM in or ...
0
votes
0answers
12 views

How can I use Xpath in Event Viewer to filter on substrings of the values of attributes?

I am trying to define Windows Eventviewer views using Xpath xml queries. I am able to select on attributes if I match on the entire value; for example [EventData[Data[@Name="Image"] and ...
0
votes
1answer
121 views

Windows 7: What is the event ID for a lock event and how to tell if it is user-initiated or not?

The following eventvwr.exe event relates to a screen unlock event: Event ID 4624 (access type: 7) (screen unlock) Now I need to find the screen lock event, so I can compare the time between when I ...
0
votes
2answers
53 views

Windows 7 Home Premium: Event ID 4624: Someone logged in when I was away

I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following: 28/10/2015 14:54:25 Event ID 4624 (access type: 2) ...
2
votes
1answer
94 views

Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events

I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
0
votes
0answers
15 views

Two or more IDs in event viewer with filter on Windows XP

Is there a way to filter 2 or more ID events. In win 7 you can use ","(e.g. 6006,6005). On the other side in XP I can't use comma to separate IDs, "unexpected input" or error like that is popping up ...
0
votes
0answers
64 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
3
votes
1answer
68 views

find out time taken by individual group policy computer startup scripts

I wish to reduce the time taken by our computer group policy. How can I find out which scripts of which group policy are run when I boot a computer, and how much time they take each? And how do I find ...
0
votes
1answer
39 views

What is the event viewer and why do scammers send you to it?

I recently received a scam call in which they tried* to direct me to the event viewer, but I couldn't seem to find any reason that they would try to gain access to it. It does not appear to have any ...
2
votes
3answers
470 views

how to get Windows event logs in English though the default language is Spanish?

I want to analyze the windows event logs that is been getting generated from windows machines. The default language for windows is Spanish so it is generating the logs in Spanish but the tool which ...
0
votes
1answer
1k views

Getting lots of Audit Failures in Event Viewer > Security on Windows Server 2008 R2

Over the past few days we have been getting loads of audit failures on the event viewer > security. I suspect they hackers trying to gain access to the server, but they fall into 2 types: One where ...
0
votes
0answers
20 views

How do I run or quit a program at a certain time with Event Viewer?

I'm using the program Tunebite to convert songs. I need to convert a lot of songs and then quit the program after all processing is complete. There's an option to shutdown after completion but not to ...
0
votes
1answer
111 views

Track RDP user session activity in windows 2003

The users are connected to windows 2003 server remotely through RDP. At times the users remain connected but inactive with their remote desktop session minimized on their desktop machine. How can ...
0
votes
1answer
77 views

Windows 7 - displaying a message if an event occurs

I'd like to get a message when event 7026 occurs. (7026 = driver failed to load) But I can't create a working task for this purpose. Creating a task on the event (In Event Viewer right click on ...
0
votes
0answers
145 views

How To Read NFC event?

I have an external NFC reader connected via usb to a Windows-7, with the drivers installed. It seems to work, as when I place a NFC card on the reader its led changes from red to green and the PC ...
0
votes
0answers
27 views

managing event viewer remotely in windows 2003

Same user is configured as administrator on all the servers in one domain at windows 2003 server. However, the account is not the domain admin. Can security logs be managed or cleared remotely from ...
0
votes
1answer
85 views

Windows Event Viewer: Access Denied while trying to view login and logoff events

I'm running a localized version of Windows 7. I've followed the following steps to view the dates and times for the login and logoff events carried out on my computer: Press WinKey + R. Type ...
0
votes
0answers
197 views

Skype 7.1 crashes at startup on Windows Enterprise

I downloaded the latest skype on my workstation, which is a Windows 7 Enterprise (Version 6.1, Build 7601: SP1). The problem is that it crashes every single time on Skype startup. I can't even write ...
0
votes
1answer
674 views

Recurring event in Event Log: “Windows Security Center Service could not stop Windows Defender”

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
1
vote
1answer
1k views

How to solve Windows 7 regular hangs after fresh install. Some diagnosis done but can't pin down

I am getting regular hangs on my windows 7 machine imedietly after installation and after updating drivers. The machine is a Dell XPS 15 (L521x). It happens approximately once every few minutes. ...
1
vote
1answer
2k views

Why is the “Task category” drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use ...
1
vote
0answers
521 views

Windows 8 crashing unexpectedly

The computer I use at work sometimes crashes when I'm not near it. The first time it happened the OS crashed dead (even the mouse cursor wasn't moving). At that time I couldn't get much information ...
1
vote
0answers
200 views

Event Viewer snapin fails after a power outage

I was in the middle of opening a saved event log from another computer when our building was hit with a power outage, and my desktop is not protected. After recovering from the power outage, I get an ...
1
vote
1answer
161 views

How to capture a windows pop-up box event in task manager or by other method?

The pop-up box event is a windows error notification with a 'OK' click box. I want to auto-click the 'OK' or suppress the appearance of the pop-up box. But how to capture this event? I can't see ...
0
votes
2answers
44 views

Where Does One Find Logs of Pentesting Tools on Windows

I'm scanning my Windows 8 machine with Nmap and OpenVAS (from a different machine on my LAN and another one over WAN) and I'm looking for logs for the occurrence of such events in the Event Viewer but ...
0
votes
0answers
50 views

stopping of event-viewer services, and performing malacious activities

what will happen if i shutdown the windows event log services. I know it will stop event viewer. My question is will this activity be logged somewhere. if yes, then where?. and where will be the ...
2
votes
1answer
9k views

Event ID:4797 “An attempt was made to query the existence of a blank password for an account.”

On my Windows 8.1 desktop, I see a lot of messages like this from lsass.exe in the Event Viewer's audit log: An attempt was made to query the existence of a blank password for an account. Subject: ...
0
votes
0answers
1k views

Tracking who deleted a folder in Windows Server

Recently there are several cases of missing or deleted files/folder from various shared folders, so we have turned on the audit policy for Delete Subfolders and Files. However there are more than 100 ...
0
votes
0answers
138 views

Event Viewer is not opening

When I double click into Event Viewer in Control Panel, nothing happens. Computer management does not open too. No any error messages displayed. If I run eventvwr from command line, also nothing ...
2
votes
1answer
86 views

Unable to filter events in event viewer

Unable to filter events in event viewer: appropriate controls are dimmed:
1
vote
1answer
132 views

Windows Event Viewer, how to create group of remote computers?

We have a file of type .msc on our computer in a domain, that when opened shows this view: However, I can find no way to edit the file to add more computers to the list. How are these files created ...
2
votes
1answer
8k views

volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C:

I have the following error appearing in Event Viewer several times per day: The shadow copies of volume C: were aborted because of an IO failure on volume C:. source: volsnap Nothing found in web ...
0
votes
1answer
83 views

Win8 Event Viewer

I recently followed the answer on this site "Uninstalled Programs History...". That opened several hours of experimentation with Event Viewer. My question; Why are there many installed programs ...
1
vote
1answer
2k views

How to find out when an application was started using the Event Viewer on Windows 8.1

I am tring to find out when an application was started using the Event Viewer on Windows 8.1. I have tried tracking the PID of the application (Winamp) from the Task Manager to the Event Viewer, but ...
6
votes
2answers
11k views

Defragmentation Error, The Volume (C:) was not Optimized

Event ID 257 The volume (C:) was not optimized because an error was encountered: The parameter is incorrect. (0x80070057) I have Windows 8.1 64 Bit (HDD) and lately I noticed the above event ...
0
votes
2answers
90 views

Acer 5738, Windows 7 random shutdowns

I can run my computer any number of hours continuously without any issue, but if I do a Skype video call (not just audio, never happens with audio call), some flash games, or even certain online ...
2
votes
1answer
12k views

Is there a log file for RDP connections (with system-name)

Is there any possible way to know the system name of the system which has taken the system remotely? From the logs we are able to know the username (but these are generic login IDs) and the IP (but we ...
0
votes
1answer
1k views

How to run Event Viewer as another user?

I want to create a shortcut to run Windows Event Viewer as another user, but the following doesn't seem to work. Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All ...
0
votes
2answers
661 views

Antivirus logging to Windows Event Viewer [closed]

I'm trying to find antivirus software with centralized management that logs 'everything' to Windows Event Viewer (or a text file). It will run in a server environment. I'm talking about these kinds of ...
-1
votes
1answer
4k views

Get windows events for a day

I'm trying to create a PowerShell Cmdlet that runs daily and shows me the errors that occured on the previous day. I can make it show the last 100. Instead I'd like to see just the one that occured ...
10
votes
6answers
40k views

How to clear all Windows event log categories fast

Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane. Assuming I want to clear ALL categories, am I ...
0
votes
0answers
7k views

Where to see logs of device connecting/disconnecting events in Windows? [duplicate]

When I connect devices to my Windows machine, the "upwards" sound is heard. When I disconnect it -- the "downwards" sound is heard. Is there a way to find events, corresponding to these sounds in ...
1
vote
0answers
443 views

How can i figure out if & which hardware may be causing a write to a file to take longer than it should?

I saw this message in Event Viewer a couple of times, and I'm not really sure what it means. How can I figure out what is causing this issue and what can I do to resolve it? Log Name: ...