Questions tagged [event-log]
The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.
375
questions
0
votes
2
answers
41
views
Does the events log have a record of when a file was created and permanently deleted?
I permanently deleted a file from my computer. Although I have the data in a later version of the file, I now realize I needed the timestamp on that file to calculate how long it took to generate the ...
- 588
1
vote
1
answer
51
views
Successful Disabled/Anonymous Guest Login. What is this?
TLDR: Windows Server logs shows successful login with a disabled Guest account. Can someone explain this activity?
In our SIEM, I saw the following event below from our Windows 2016 Server (not a DC).
...
- 117
0
votes
1
answer
23
views
Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
-1
votes
0
answers
22
views
EventLog Security
To summarize, my goal is to delete Event 4616 from the Windows Event Viewer, specifically a single event.
To clarify, this event is generated whenever the date/time of Windows is changed. I have tried ...
- 1
-1
votes
0
answers
93
views
Can somebody help me get HP Hardware diagnostics to run in Windows 10? It stopped running presumably after some updates
HP Hardware Diagnostics seems to be conflicting with .net core/.net runtime since a windows update. It stopped running within windows. I would appreciate assistance. Note: I have obtained this log by ...
1
vote
0
answers
566
views
Event viewer - Offline downlevel migration succeeded
So my event log has this event that happened in the future?
Looking it up didn't really help me, so I was wondering if anyone here knows if this is something to worry about.
Information 31/12/2023 23:...
- 200
0
votes
0
answers
25
views
Can't get Winlogon automatic restart sign-on (ARSO) to work on a specific machine
I'm trying to get Windows ARSO to work on a machine but am unable to. (Windows 10 Pro 22H2)
It runs on other machines just fine, but not this specific machine. I've read through and double checked the ...
- 312
0
votes
0
answers
78
views
How often is CAPI2 on Windows 10 meant to be updating third part root certificates and their properties with event 4109 and 4097?
Looking through my event logs, I came across two that seem very infrequent given their purpose:
4109- successful auto property update of third-party root certificate
4097- successful auto update of ...
- 73
0
votes
0
answers
236
views
Weird message in event log: "Microsoft Defender Antivirus ϋśèď сľöüδ ргοτэсŧιőň тο ġěţ ąðδίŧΐŏńάľ ѕеςųгĩŧý ΐиŧéľŀìģεπčз"
A relative of mine complained of a slow computer. At my suggestion, they rescanned the hard drive. It found issues, but the on-screen information was quite useless so I checked the Event Log. Several ...
- 139
1
vote
1
answer
340
views
Mapping the wlceventd logs and their wlceventd_proc_event
I'm trying to monitor the logs that my Asus router are generating, so I can react on certain events.
Some of the interesting ones are from the Wireless LAN Controller event daemon (wlceventd), e.g. ...
- 113
0
votes
1
answer
29
views
Where can I get information if my computer refuses a connection?
As mentioned in this Stackoverflow post, I'm having trouble connecting to "localhost": I get the error message that the connection gets refused.
As far as I know, when something happens to ...
- 1,921
1
vote
0
answers
391
views
Windows Event Viewer ID for when certificate is installed
Is there any where in Windows Event Viewer that can show when a new certificate is installed on user or machine certificate stores?
All I found is this:
https://social.technet.microsoft.com/wiki/...
user1752038
0
votes
1
answer
118
views
Windows 11 - C:\Windows is a file not a directory of size 0 B. DISM tool try repair and other methods
C:\Windows is a file of size 0 B.
What is happening in the system:
Explorer.exe
Location is not available.
C:\ not available.
Access denied.
WinAnotherOS:\Users\user01>C:
Access denied
...
0
votes
0
answers
30
views
HyperV spams event log with verbose entries
So, HyperV is spamming my event log with verbose entries about Ioctl begin and end. Is there a way to keep those messages from being logged such as changing the minimum log level?
Yak Shaving stack ...
- 362
0
votes
1
answer
117
views
Include the Windows Event Log in UWF exclusions
I need to track unexpected restarts of an industrial system that uses UWF in Windows 10 LTSC, but I noticed that the Logs are cleaned when the system restarts, leaving only the last ones recorded when ...
- 111
0
votes
0
answers
87
views
DebugChannel error in Windows 11 Event Viewer
I've started getting this error when I open the Event Viewer on Windows 11:
DebugChannel error
I don't look at the Event Viewer regularly so I can't pinpoint when it started happening. The log in ...
0
votes
0
answers
16
views
how I can integrate damware with qradar?
we are using product “Dameware Mini Remote Control” for Desktop support and want to integrate the Dameware with Qradar SIEM so that we will be able to see the logs for our analysis and to detect who ...
- 1
0
votes
0
answers
31
views
Security Events generated for Linux clients don't contain Usernames
This is my third question regarding the ongoing problem I'm facing with "Linux to AD SSO". I've been trying to understand what the problem was and still not sure I know exactly the cause.
...
- 103
0
votes
1
answer
87
views
How domain joined Linux clients send Security Events to the AD (KDC)
Have been trying to solve an issue for two weeks with no success. So I will break it into smaller questions in hope to understand the process and find a solution.
We have a Windows AD domain with some ...
- 103
0
votes
0
answers
136
views
TargetUserName in Events display ComputerName$ for Linux Clients
I'm trying to implement a hardware UTM (Firewall) to use SSO. The SSO Server that I configured for this purpose uses the Active Directory (DC) security event logs. These logs tell the SSO system which ...
- 103
1
vote
0
answers
224
views
Why are no Microsoft-Windows-Power-Troubleshooter events logged?
for a script a need to read the Microsoft-Windows-Power-Troubleshooter events (wake time, wake duration, wake source) but there is no event registered from Microsoft-Windows-Power-Troubleshooter on ...
- 11
0
votes
1
answer
389
views
How do I locate the actual log and disable events by event id?
Screenshot of event viewer usb event log:
When I right click on other event logs, such as AMSI/Operational, I see the option 'disable/enable' but when I right click on the event log about a usb, ...
- 3
2
votes
2
answers
3k
views
Is it possible to log powershell scripts which executed on my computer?
Title says it all. I already turned on logging via regedit but I want something more stable. I would like to see every commands which executed on powershell to be in my event log just like Sysmon.
- 141
0
votes
0
answers
119
views
Windows Event Collector unreliable log delivery
First time poster here! I'm duplicating a post from a couple other forums I haven't gotten traction on. I figure this is a fringe enough issue and I can't find anything about on Google so I'll post it ...
- 11
1
vote
2
answers
30
views
Is it possible to log events of every user in one Event Log?
Right now if AppLocker blocks a program it is only logged in the local EventLog of the user.
Is it possible to set up one Event Log where the events of any user are logged that can be accessed by an ...
- 13
0
votes
0
answers
197
views
Why are there 2 wifi.log reports on console in Mac
So today while I was checking my console log.reports today, I saw there there are two Wifi logs, one is the general one which is the Wifi.log and the other is a new one called Wifi.07.05.6:34.log.
...
1
vote
1
answer
506
views
Windows 10 security mitigations blocking chrome.exe from generating dynamic code
Looking in Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode, I seem to have two programs that consistently appear in here:
steamwebhelper.exe' (...
- 73
0
votes
1
answer
397
views
How to Forward Windows Print Log to Syslog
I want to collect logs from various machine (windows and linux) to a centralized log server. The log server has been configured and is listening on port 514 tcp and udp for log in syslog protocol.
I ...
- 101
0
votes
0
answers
985
views
Winlogon Event ID 811/812 event tags
In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
- 1
1
vote
1
answer
347
views
How to track device IDs assignments in Windows?
Is there a way to keep track of device IDs as they're assigned by the OS? I'm using Windows 8.1, trying to track mouse IDs in specific. A cursory glance at the System logs turned nothing useful.
To ...
- 722
0
votes
0
answers
51
views
Inconsistent INACCESSIBLE_BOOT_DEVICE error
There is a weird type of error occasionally occurring on my device (today and the last time before, 1 week ago). After pressing the power button of my notebook (specs below) Windows (version below) ...
- 725
0
votes
1
answer
474
views
What do the event tags 0-13 mean in Microsoft-Windows-Winlogon/Operationsl.evtx events 811 and 812 mean?
Our company runs Win10 Enterprise systems and remote login using PIV and Pulse Secure. When looking at a user's logon/logoff times, I found codes 811 and 812 have tags associated with these events. ...
- 1
0
votes
0
answers
77
views
Audio/Screen Output is lagging every 7 minutes
I have had this problem since I installed Windows 10 about 2 years ago (new custom PC), but the problem was occuring very rarely until a couple of days ago. I have tried Windows reset, clean install ...
- 1
0
votes
0
answers
303
views
Windows Events 229 and 600, what do they mean?
The following event for the RemoteDesktopServices shows up in the EventLog, what does it mean?
Event ID: 229,
Channel: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational,
Level: ...
- 101
0
votes
0
answers
390
views
Does the "PlatformRollbackMethod" Windows Defender event indicate an issue?
For about a month I've been seeing this "PlatformRollbackMethod" in event viewer (Microsoft-Windows-Windows Defender/Operational)
Is this a common event, or an unusual one that might ...
- 87
1
vote
0
answers
85
views
What to check when a stranger uses your computer
My significant other is a lecturer in Social Sciences at a university and today one of their students did not manage to bring a laptop to her class in a class that needed one. She ended up offering ...
- 111
1
vote
0
answers
2k
views
Windows Defender Advanced Threat Protection eating all available ram before crashing
For couple of days now I've been experiancing issues, where Windows Defender ATP process just starts to grab all my RAM, reaching up to 40GB of 48 available and then crashing. I've noticed a lot of &...
- 11
0
votes
1
answer
603
views
Windows 10, how can I find out what ran a powershell script at a certain time
I have a blocked powershell.exe writing to a protected folder. is there any log that can tell me what triggered the powershell.exe? i have the timestamp of when it was blocked.
- 1
0
votes
0
answers
323
views
How many linked clones does VMware Workstation Pro 16 support?
I'm on Windows 10 with VMware Workstation Pro 16.1.0 build-17198959. I've created a Win 10 guest VM and created 3 linked clone from it. The three cloned VM are running in parallel and everything works....
- 471
0
votes
0
answers
50
views
Print to PDF intermittently fails -- is is this logged?
Referencing many how-to guides:
https://softwarekeep.com/help-center/fixed-microsoft-print-to-pdf-feature-not-working
on a Windows 10 PC where I'm just a user the print-to-PDF feature will ...
0
votes
1
answer
3k
views
Windows Server 2016 not writing events to Security Event Log
I have two computers inside an Active Directory domain (one of which is the secondary Domain Controller) which stopped logging Security events last March and April respectively.
Other Event Logs (...
- 261
0
votes
1
answer
2k
views
How to run a script when the screen is turned off for being idle?
just wondering whether its possible to run a script when Windows turns the screen off after a period of inactivity (not sleep or hibernate but just switching off the screen) as well as when the user ...
- 3
0
votes
1
answer
75
views
What is the meaning of `DeviceTime` in Windows event log event "6" messages
Examining some interesting event happening on Windows 10, I read the Window events event log.
I saw some date-like strings (e.g.: 2080-03-16T14:57:52) that made me wonder (the text message in German ...
- 466
0
votes
0
answers
60
views
Determine if user logged in at work or at home
I have a corporate laptop with Windows 10 (1709). Since COVID, I work from home and only very rarely in the office. Working from home means I log in without a connection to the company (cached ...
- 1,898
2
votes
1
answer
1k
views
Querying event viewer in cmd
Various sources such as this one suggest using a eventquery.vbs on the system to query the event log from cmd. Apparently my stock install of Windows 10 is missing that file:
Microsoft Windows [...
- 23
0
votes
1
answer
558
views
Properties in windows event ID 41
I want to understand the significance of the values for each property in Windows event Log ID 41.
Windows System event ID 41 from source Kernel-Power has the following properties
- EventData
...
- 101
0
votes
1
answer
1k
views
Weird file on my flash drive?
I was using a FAT32 formatted flashdrive on Ubuntu earlier, and when I booted into Windows 10 (cuz yes, I have a dual-boot setup), there was an extra file on the drive. Here's what it said:
Filename: ...
1
vote
1
answer
186
views
'Device Connected' sound plays on Windows 10 over and over
I keep getting the 'Device Connected' Sound on my Windows 10 PC. It plays repeatedly, anywhere from about a minute between each one to playing several in quick succession.
I've installed USBLogView ...
- 13
0
votes
0
answers
560
views
Something cause BSOD. A device attached to the system is not functioning
For some time now I started getting BSOD screens. Just now after the one IRQL NOT LESS OR EQUAL, right after system rebooting I opened Event Viewer and the last one error message was:
The Network ...
- 457
1
vote
1
answer
11k
views
What is the nhi event source and its event id 1 in the Microsoft windows system event log?
On a Dell Precision 7720 laptop running Microsoft Windows 10, Version 20H2, OS Build 19042.867, I see the following event showing up in the Windows System event log:
<Event xmlns="http://...
- 123