Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.

learn more… | top users | synonyms

0
votes
1answer
3k views

System date change tracking in windows xp

I wanted to track when system time was changed in a PC.By looking at event viewer for event id 520 i will get it. But when i changed date manually in windows and look at event viewer i found 4 entries ...
0
votes
0answers
5 views

Audit Power Settings change

I helped with a machine that was stopping whilst running many samples in automatic mode. We found that it was because the machine was going to sleep during production. The settings should be never for ...
13
votes
6answers
48k views

How to clear all Windows event log categories fast

Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane. Assuming I want to clear ALL categories, am I ...
2
votes
2answers
5k views

Can't Open Up Event Viewer

I just installed a large backlog of Windows Updates (I have Windows 7 Ultimate 64-bit) and now a handful of programs are acting strangely (not opening, crashing, etc) I went to try to diagnose the ...
0
votes
0answers
50 views

Solving Windows 10 “Activation permission for the COM Server application”

On a clean genuine Windows 10 installation, the Event Viewer throws one of these errors every 2-5 minutes: The application-specific permission settings do not grant Local Activation permission ...
1
vote
0answers
30 views

What is the source of Printer Status Events in Windows 10?

While looking at Event Viewer, if I send a file to Print, I can see various entries in the logs regarding spooling and cancelled jobs - all located in: Microsoft->Windows->PrintSystems But if ...
1
vote
3answers
42 views

Notepad++ regex not working

I am trying to use Notepad++ and regular expressions to remove all XML from Windows' events. My regular expression is as follows: Event Xml:(.|\n)+?Event>\n Example Windows events are as ...
0
votes
1answer
60 views

How to check the event log (if any) for network failure?

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" ...
0
votes
2answers
379 views

How Do I Suppress SQL Server “Informational” Messages?

I've just installed SQL Server 2008 R2 Express for local development, and it's flooding the Application Event Log with a seemingly endless barrage of trivia and drivel ("SQL Server is now ready for ...
0
votes
1answer
35 views

Modifying script to capture login/shutdown times in Windows

For some time now I've been using this script to view my login time for a particular computer: Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFile = objFSO.GetFile("C:\Windows\...
4
votes
2answers
652 views

Windows 10 Search, Cortana, and Edge crashing

I have a relatively new install of Win10 Enterprise (Bitlocker enabled - hardware encryption with Samsung EVO 850 500 GB SSD) on a Lenovo T450s laptop, and despite having not set it up much yet for ...
0
votes
1answer
549 views

SQL Server: Audit permission denied

Is there any easy way to see those events in SQL Server 2008 for which permission was denied on a query (along with the text of the query and the specific object that permission was denied to)? I ...
0
votes
1answer
28 views

How can I use Xpath in Event Viewer to filter on substrings of the values of attributes?

I am trying to define Windows Eventviewer views using Xpath xml queries. I am able to select on attributes if I match on the entire value; for example [EventData[Data[@Name="Image"] and (Data="C:\...
0
votes
0answers
30 views

XML Xpath for Windows event?

I'm trying to create an event filter based on the following event XML (an example), but I seemed to be missing something: <?xml version="1.0" encoding="utf-8" standalone="yes"?> <Events>&...
3
votes
1answer
2k views

Identifying Windows 10 \Device\Harddisk1\DR2

I'm getting errors in Windows 10's event log stating \Device\Harddisk1\DR2 drive controller is having a problem. I know that the hard disk numbers depend on the BIOS and do not match the physical ...
3
votes
2answers
11k views

Event 4797 “An attempt was made to query the existence of a blank password for an account”

On my Windows 8.1 desktop, I see a lot of messages like this from lsass.exe in the Event Viewer's audit log: An attempt was made to query the existence of a blank password for an account. Subject: ...
0
votes
0answers
105 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
0
votes
0answers
13 views

How to start Windows Event Viewer in Application node filtered for a specific provider?

My goal is to start Windows Event Viewer from a command line, with the Application node already selected, showing only entries for my specific application, or provider? In other words, I need to ...
0
votes
1answer
716 views

Event ID: 7016 LitModeCtrl service has reported an invalid current state 32

I am getting all the time the below error in Windows Event Viewer. Throughout the web a lot of people get this error but there are no solutions to it. I was getting the error when i was using Windows ...
0
votes
2answers
2k views

Explorer crashing repeatedly in Win 10 Ver 1511: explorerframe.dll culprit?

Recently (within 3-4 days or so) my explorer has been crashing regularly but inconsistently (i.e. persistent attempts at viewing a particular folder will eventually work.) I checked the Windows Event ...
0
votes
1answer
66 views

Server automatically shuts down at night for no apparent reason

Since a couple of weeks, I find my Windows 2008 R2 Server down every morning. I have checked the battery and it is not the problem. I turn ON the machine and it works normally, until it shuts down on ...
1
vote
2answers
221 views

Export Windows XP event logs cmd

I need to export a specific Windows XP event log from the eventviewer to a ".txt" file. My scenario is that the user programs a chkdsk to be execute on next reboot into a remote machine, and after ...
1
vote
1answer
130 views

What do these errors in Event Viewer mean?

I have been getting a lot of Event ID 10 errors when starting up my Windows 7 Ultimate 64 Bit(SP1). Two errors (sources are WMI and Service Control Manager) are seen very often that on every start-up ...
0
votes
0answers
18 views

View multiple Event Viewer logs From USB

I've copied the entire Windows event viewer log folder onto a USB, and I'm trying to view them in an Event Viewer on another PC, but I can only open one log at a time. Is there a way that I can open ...
0
votes
1answer
760 views

Recurring event in Event Log: “Windows Security Center Service could not stop Windows Defender”

I have recently set up a new development machine (Lenovo T440p laptop with Windows 8.1 Pro), and this event keeps getting logged to the Event Log (about once every 2.5 minutes): The Windows Security ...
2
votes
1answer
144 views

Windows 7 (Home Premium): eventvwr.exe: How to log workstation locking and unlocking and screensaver invoked and dismissed events

I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe when ...
0
votes
0answers
25 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
0
votes
0answers
41 views

How to force Windows Error Events for educational purposes

I'm looking to show some colleagues how to use the Event Viewer in Windows and would like a way create some Error and Warning messages on a demo machine. I know I could throw some dodgy RAM in or ...
0
votes
1answer
525 views

Windows 7: What is the event ID for a lock event and how to tell if it is user-initiated or not?

The following eventvwr.exe event relates to a screen unlock event: Event ID 4624 (access type: 7) (screen unlock) Now I need to find the screen lock event, so I can compare the time between when I ...
0
votes
2answers
89 views

Windows 7 Home Premium: Event ID 4624: Someone logged in when I was away

I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following: 28/10/2015 14:54:25 Event ID 4624 (access type: 2) 28/10/...
0
votes
0answers
17 views

Two or more IDs in event viewer with filter on Windows XP

Is there a way to filter 2 or more ID events. In win 7 you can use ","(e.g. 6006,6005). On the other side in XP I can't use comma to separate IDs, "unexpected input" or error like that is popping up ...
3
votes
1answer
120 views

find out time taken by individual group policy computer startup scripts

I wish to reduce the time taken by our computer group policy. How can I find out which scripts of which group policy are run when I boot a computer, and how much time they take each? And how do I find ...
2
votes
0answers
58 views

what physical disk is referenced by Event 7, Disk error “The device, \Device\Harddisk2\DR2, has a bad block.” [duplicate]

Possible Duplicate: How do I determine which HD is involved in the Event Viewer? NOT a duplicate well, maybe the general premise is a duplicate, but the linked question is not answered, only ...
0
votes
1answer
44 views

What is the event viewer and why do scammers send you to it?

I recently received a scam call in which they tried* to direct me to the event viewer, but I couldn't seem to find any reason that they would try to gain access to it. It does not appear to have any ...
2
votes
1answer
15k views

Is there a log file for RDP connections (with system-name)

Is there any possible way to know the system name of the system which has taken the system remotely? From the logs we are able to know the username (but these are generic login IDs) and the IP (but we ...
1
vote
0answers
600 views

Windows 8 crashing unexpectedly

The computer I use at work sometimes crashes when I'm not near it. The first time it happened the OS crashed dead (even the mouse cursor wasn't moving). At that time I couldn't get much information ...
2
votes
3answers
776 views

how to get Windows event logs in English though the default language is Spanish?

I want to analyze the windows event logs that is been getting generated from windows machines. The default language for windows is Spanish so it is generating the logs in Spanish but the tool which i'...
0
votes
1answer
2k views

Getting lots of Audit Failures in Event Viewer > Security on Windows Server 2008 R2

Over the past few days we have been getting loads of audit failures on the event viewer > security. I suspect they hackers trying to gain access to the server, but they fall into 2 types: One where ...
0
votes
1answer
170 views

Track RDP user session activity in windows 2003

The users are connected to windows 2003 server remotely through RDP. At times the users remain connected but inactive with their remote desktop session minimized on their desktop machine. How can ...
0
votes
0answers
23 views

How do I run or quit a program at a certain time with Event Viewer?

I'm using the program Tunebite to convert songs. I need to convert a lot of songs and then quit the program after all processing is complete. There's an option to shutdown after completion but not to ...
0
votes
1answer
95 views

Windows 7 - displaying a message if an event occurs

I'd like to get a message when event 7026 occurs. (7026 = driver failed to load) But I can't create a working task for this purpose. Creating a task on the event (In Event Viewer right click on ...
3
votes
1answer
10k views

volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C:

I have the following error appearing in Event Viewer several times per day: The shadow copies of volume C: were aborted because of an IO failure on volume C:. source: volsnap Nothing found in web ...
0
votes
0answers
227 views

How To Read NFC event?

I have an external NFC reader connected via usb to a Windows-7, with the drivers installed. It seems to work, as when I place a NFC card on the reader its led changes from red to green and the PC ...
0
votes
1answer
110 views

Windows Event Viewer: Access Denied while trying to view login and logoff events

I'm running a localized version of Windows 7. I've followed the following steps to view the dates and times for the login and logoff events carried out on my computer: Press WinKey + R. Type ...
1
vote
0answers
233 views

Event Viewer snapin fails after a power outage

I was in the middle of opening a saved event log from another computer when our building was hit with a power outage, and my desktop is not protected. After recovering from the power outage, I get an ...
0
votes
0answers
7k views

Where to see logs of device connecting/disconnecting events in Windows? [duplicate]

When I connect devices to my Windows machine, the "upwards" sound is heard. When I disconnect it -- the "downwards" sound is heard. Is there a way to find events, corresponding to these sounds in ...
9
votes
3answers
31k views

List of all Windows 7 Event IDs and Sources?

I'm looking for a complete list of Sources + Event IDs for Windows 7. I known there's many web site with built-in search to find informations about a specific source + event id such as Eventid.net ...
1
vote
1answer
2k views

How to solve Windows 7 regular hangs after fresh install. Some diagnosis done but can't pin down

I am getting regular hangs on my windows 7 machine imedietly after installation and after updating drivers. The machine is a Dell XPS 15 (L521x). It happens approximately once every few minutes. ...
1
vote
1answer
3k views

Why is the “Task category” drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?...
1
vote
1answer
232 views

How to capture a windows pop-up box event in task manager or by other method?

The pop-up box event is a windows error notification with a 'OK' click box. I want to auto-click the 'OK' or suppress the appearance of the pop-up box. But how to capture this event? I can't see ...