Questions tagged [event-log]

The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Windows 10 security mitigations blocking chrome.exe from generating dynamic code

Looking in Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode, I seem to have two programs that consistently appear in here: steamwebhelper.exe' (...
user avatar
0 votes
1 answer
14 views

How to Forward Windows Print Log to Syslog

I want to collect logs from various machine (windows and linux) to a centralized log server. The log server has been configured and is listening on port 514 tcp and udp for log in syslog protocol. I ...
user avatar
  • 101
0 votes
0 answers
15 views

Winlogon Event ID 811/812 event tags

In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
user avatar
1 vote
1 answer
18 views

How to track device IDs assignments in Windows?

Is there a way to keep track of device IDs as they're assigned by the OS? I'm using Windows 8.1, trying to track mouse IDs in specific. A cursory glance at the System logs turned nothing useful. To ...
user avatar
  • 674
0 votes
0 answers
24 views

Inconsistent INACCESSIBLE_BOOT_DEVICE error

There is a weird type of error occasionally occurring on my device (today and the last time before, 1 week ago). After pressing the power button of my notebook (specs below) Windows (version below) ...
user avatar
0 votes
1 answer
53 views

What do the event tags 0-13 mean in Microsoft-Windows-Winlogon/Operationsl.evtx events 811 and 812 mean?

Our company runs Win10 Enterprise systems and remote login using PIV and Pulse Secure. When looking at a user's logon/logoff times, I found codes 811 and 812 have tags associated with these events. ...
user avatar
0 votes
0 answers
63 views

Audio/Screen Output is lagging every 7 minutes

I have had this problem since I installed Windows 10 about 2 years ago (new custom PC), but the problem was occuring very rarely until a couple of days ago. I have tried Windows reset, clean install ...
user avatar
  • 1
0 votes
0 answers
92 views

Windows Events 229 and 600, what do they mean?

The following event for the RemoteDesktopServices shows up in the EventLog, what does it mean? Event ID: 229, Channel: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational, Level: ...
user avatar
  • 101
0 votes
0 answers
111 views

Does the "PlatformRollbackMethod" Windows Defender event indicate an issue?

For about a month I've been seeing this "PlatformRollbackMethod" in event viewer (Microsoft-Windows-Windows Defender/Operational) Is this a common event, or an unusual one that might ...
user avatar
  • 77
1 vote
0 answers
78 views

What to check when a stranger uses your computer

My significant other is a lecturer in Social Sciences at a university and today one of their students did not manage to bring a laptop to her class in a class that needed one. She ended up offering ...
user avatar
  • 111
0 votes
0 answers
39 views

How to trigger a WIndows task based on a process terminating?

I'd just like to run BleachBit on the command line when my browsers close, to simulate the convenience of certain commercial software I have no interest in having on my computer anymore. It's pretty ...
user avatar
  • 61
1 vote
0 answers
894 views

Windows Defender Advanced Threat Protection eating all available ram before crashing

For couple of days now I've been experiancing issues, where Windows Defender ATP process just starts to grab all my RAM, reaching up to 40GB of 48 available and then crashing. I've noticed a lot of &...
user avatar
0 votes
1 answer
90 views

Windows 10, how can I find out what ran a powershell script at a certain time

I have a blocked powershell.exe writing to a protected folder. is there any log that can tell me what triggered the powershell.exe? i have the timestamp of when it was blocked.
user avatar
  • 1
0 votes
0 answers
44 views

How many linked clones does VMware Workstation Pro 16 support?

I'm on Windows 10 with VMware Workstation Pro 16.1.0 build-17198959. I've created a Win 10 guest VM and created 3 linked clone from it. The three cloned VM are running in parallel and everything works....
user avatar
0 votes
0 answers
24 views

Print to PDF intermittently fails -- is is this logged?

Referencing many how-to guides: https://softwarekeep.com/help-center/fixed-microsoft-print-to-pdf-feature-not-working on a Windows 10 PC where I'm just a user the print-to-PDF feature will ...
user avatar
0 votes
1 answer
632 views

Windows Server 2016 not writing events to Security Event Log

I have two computers inside an Active Directory domain (one of which is the secondary Domain Controller) which stopped logging Security events last March and April respectively. Other Event Logs (...
user avatar
  • 211
0 votes
1 answer
307 views

How to run a script when the screen is turned off for being idle?

just wondering whether its possible to run a script when Windows turns the screen off after a period of inactivity (not sleep or hibernate but just switching off the screen) as well as when the user ...
user avatar
  • 3
0 votes
1 answer
30 views

What is the meaning of `DeviceTime` in Windows event log event "6" messages

Examining some interesting event happening on Windows 10, I read the Window events event log. I saw some date-like strings (e.g.: 2080-03-16T14:57:52) that made me wonder (the text message in German ...
user avatar
  • 304
0 votes
0 answers
52 views

Determine if user logged in at work or at home

I have a corporate laptop with Windows 10 (1709). Since COVID, I work from home and only very rarely in the office. Working from home means I log in without a connection to the company (cached ...
user avatar
  • 1,878
1 vote
1 answer
179 views

Querying event viewer in cmd

Various sources such as this one suggest using a eventquery.vbs on the system to query the event log from cmd. Apparently my stock install of Windows 10 is missing that file: Microsoft Windows [...
user avatar
0 votes
0 answers
27 views

Watched process exited with code

At the Windows Event Viewer, each one second, the Warning "Watched process exited with code" appeared, together with the event logged time. And that is!. No more data, path, process ID, etc. ...
user avatar
0 votes
1 answer
204 views

Properties in windows event ID 41

I want to understand the significance of the values for each property in Windows event Log ID 41. Windows System event ID 41 from source Kernel-Power has the following properties - EventData ...
user avatar
0 votes
1 answer
190 views

Weird file on my flash drive?

I was using a FAT32 formatted flashdrive on Ubuntu earlier, and when I booted into Windows 10 (cuz yes, I have a dual-boot setup), there was an extra file on the drive. Here's what it said: Filename: ...
user avatar
1 vote
1 answer
32 views

'Device Connected' sound plays on Windows 10 over and over

I keep getting the 'Device Connected' Sound on my Windows 10 PC. It plays repeatedly, anywhere from about a minute between each one to playing several in quick succession. I've installed USBLogView ...
user avatar
0 votes
0 answers
266 views

Something cause BSOD. A device attached to the system is not functioning

For some time now I started getting BSOD screens. Just now after the one IRQL NOT LESS OR EQUAL, right after system rebooting I opened Event Viewer and the last one error message was: The Network ...
user avatar
  • 407
1 vote
1 answer
3k views

What is the nhi event source and its event id 1 in the Microsoft windows system event log?

On a Dell Precision 7720 laptop running Microsoft Windows 10, Version 20H2, OS Build 19042.867, I see the following event showing up in the Windows System event log: <Event xmlns="http://...
user avatar
0 votes
0 answers
83 views

ErrorCode 87 in Event Viewer

On my Windows 10 sometimes I hear sound indicating that a device that was connected either via USB or Bluetooth was removed but I don't know which device was it and notifications pane doesn't have ...
user avatar
0 votes
1 answer
50 views

Is there a way to filter Windows Event Logs by user?

I have my kid using my computer with a separate account and I would like to see all the events triggered by his user account. Is there a way to do this either with the Event Viewer or Powershell?
user avatar
  • 31
-3 votes
2 answers
186 views

Have I been hacked?

I recently received my laptop from repair and I just had a hunch that something fishy might have happened so I checked the log files on Windows Event Viewer and it turns out that my laptop has been ...
user avatar
1 vote
0 answers
148 views

Scheduling an event based on USB device connect/disconnect in Windows 10

I have two PCs and a single set of peripherals between them. Whenever I want to switch PCs, I have to swap the monitor input, change audio source and switch over my peripherals by pressing a button on ...
user avatar
  • 111
1 vote
0 answers
114 views

Input Queue Tracing with ETW Microsoft-Windows-Win32k

I have UI lags when the machine is busy. When I click on different windows on my UI the selection is not changing which indicates a blocked message queue. After some time 20s or longer the click ...
user avatar
0 votes
0 answers
33 views

How can document bad internet performance frequency over certain time period?

Recently, due to bad quality of internet in my new flat, I tried to figure out to document internet-drops logs over a certain period of time (not asking about when a connection is made or lost, but ...
user avatar
  • 101
0 votes
2 answers
126 views

Determine what changed my desktop wallpaper

How do I determine what caused the change of my background wallpaper? Identify the programm/process if that was a malware, get event information, anything? Somehow find out why that happened. My ...
user avatar
  • 11
0 votes
0 answers
403 views

Do not log event id 4688 – A new process has been created

Using Group Policy Editor (gpedit.msc) or Local Security Policy (secpol.msc) Security Settings -> Audit Policy -> Audit Process Tracking or Advanced Audit Policy Configuration -> System Audit ...
user avatar
  • 183
1 vote
0 answers
7k views

What is the cause of this windows Event Error: CbsPackageServicingFailure2

I'm having an issue figuring out what the cause of the error below is. This error is appearing in the windows logs every ten seconds. I'm worried about what could happen to the system with this error ...
user avatar
0 votes
1 answer
374 views

How can I repair "Failed to start service WMS"

I'm receiving constantly this error on windows event viewer Failed to start service WMS. Program C:\Windows\wmu2\wininit.exe couldn't be launched. CreateProcess() failed: The system cannot find the ...
user avatar
  • 103
0 votes
1 answer
16 views

Find out what uninstalled my application

I have an application, soundswitch, which I use on a daily basis (using keyboard shortcuts it switches sound device). Yesterday my keyboard shortcuts did not work, but I just thought something ...
user avatar
  • 111
0 votes
1 answer
150 views

How to check wifi connection duration in windows 10

I am using windows 10 on my computer system and I would like to know when did I connect and disconnect my WIFI connection. Is it possible to obtain that record in Events log? If not where can I find ...
user avatar
  • 1
0 votes
1 answer
33 views

Windows 10 keeps suspending whenever i use keyboard

Whenever I'm working on word of at any other place requiring keyboard usage, my windows randomly goes on suspended mode. I checked the event viewer and it turned out there was some restarting ...
user avatar
  • 101
0 votes
1 answer
647 views

How to find WiFi related events\logs in win10

Is anyway to find WiFi related events\logs in win10? My computer is connected to a specific WiFi and i want to know on what date this WiFi is defined in my windows.
user avatar
  • 1
1 vote
1 answer
208 views

WinEventLog for monitoring BitLocker

I am a Newbie to Splunk and working on monitoring the BitLocker process. I wondered if I could leverage any Windows Security logs to check whether the BitLocker was enabled by someone to encrypt files ...
user avatar
  • 11
1 vote
1 answer
162 views

Continuously "Response: Not available" Windows 10 event logs

I continuously gets the following event log in Windows 10 ver. 1809 LTSC: Fault bucket , type 0 Event Name: CbsPackageServicingFailure2 Response: Not available Cab Id: 0 Problem signature: P1: 10.0....
user avatar
  • 242
0 votes
0 answers
261 views

Analyzing windows event logs on another windows system with less event publishers

When analyzing saved event logs from another PC, one may see the following instead of an event description: "The description for Event ID [] from source [] cannot be found. Either the component ...
user avatar
1 vote
1 answer
452 views

How do I determine which Windows services were recently disabled?

Does Windows 10 keep a log of when/which services were enabled/disabled? How would a person locate this information? Thanks!
user avatar
1 vote
0 answers
6k views

How to fix CPU problems in Windows EventLog service?

The EventLog service in my machine (running under svchost.exe) is using a lot of CPU. I assume it's because some application, driver or component is generating too many logs. How can I spot this ...
user avatar
  • 123
1 vote
0 answers
266 views

How to trigger an event when an ISO is mounted on windows? [closed]

I need to run a windows service when a particular ISO is mounted. I know that an Event Trigger can be defined to do something like this but I couldn't find an event to subscribe to. How can I detect ...
user avatar
0 votes
2 answers
115 views

How do you capture programs/scripts that run and quickly disappear in Windows 10?

I have noticed that a CMD script seems to randomly run while doing things but cannot seem to capture what or where it's coming from. Is there a way to use some sort of logging app to see what comes ...
user avatar
1 vote
1 answer
293 views

How can clear Microsoft-Windows-Diagnosis-DPS/Operational event log with powershell command?

I wanna clear Operational type logs in the following path in Event Viewer : Applications and Services Logs / Microsoft / Windows / DriverFrameworks-UserMode I tried with this command in power-shell ...
user avatar
2 votes
1 answer
1k views

Where to get schemas for log events for windows 10?

For example, "Microsoft-Windows-Kernel-Power" source contains bunch of power related data, for example, event with id 507 looks like this: <Event xmlns="http://schemas.microsoft....
user avatar
  • 121
2 votes
1 answer
3k views

Bluetooth connection log

Is there a way to obtain the Bluetooth connection history from windows 10? I want to find out how long a device remained connected? I checked the details tab under device manager. But it only shows ...
user avatar

1
2 3 4 5
8