Questions tagged [event-viewer]
Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.
226
questions
2
votes
1
answer
50
views
Any way to see in EventViewer if a Windows logon was made using password Vs. fingerprint?
I suspect someone logged on to my computer (windows 10) (this is someone I know who might have access to my password), I see so many logons that I can't be sure which were mine, but what I do know is ...
- 21
0
votes
1
answer
16
views
EventViewer: Custom view Ok button grayed out
I am trying to create a Custom View by Source in Event Viewer. But when I do this, the OK button is grayed out. Does anyone know how to solve this?
I am using Windows 10, and the Event Viewer is run ...
- 213
0
votes
1
answer
23
views
Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
0
votes
1
answer
54
views
Need permissions to delete event log
I have an application that I wanted to delete but when I tried doing so, it said that it couldn't be deleted because was open in the event log.
Since I didn't want to do it manually, I found this ...
- 1
1
vote
0
answers
24
views
A Slack message was sent out during the time when Eventviewer logs show the computer was on sleep mode. Is it possible?
Could anyone please advise me?
Using my computer, a Slack message was sent out at the time stamped during the time when Event viewer logs show the computer was on sleep mode. Is it possible? If it ...
- 11
1
vote
0
answers
411
views
Windows Event Viewer ID for when certificate is installed
Is there any where in Windows Event Viewer that can show when a new certificate is installed on user or machine certificate stores?
All I found is this:
https://social.technet.microsoft.com/wiki/...
user1752038
1
vote
0
answers
110
views
Troubleshooting Windows Event Viewer USB error 0x26 status 0xc000038e [closed]
I need some guidance in how to troubleshoot a low level issue I am facing with some USB devices.
Background: I have a .NET Windows Service that, scans connected USB devices via WMI queries + reads low ...
- 167
0
votes
0
answers
88
views
DebugChannel error in Windows 11 Event Viewer
I've started getting this error when I open the Event Viewer on Windows 11:
DebugChannel error
I don't look at the Event Viewer regularly so I can't pinpoint when it started happening. The log in ...
0
votes
2
answers
64
views
Weird folders in event viewer. Can't tell if they’re legit or something else [duplicate]
The Microsoft folders in my event viewer looks weird, I do not know how to describe this better
Any idea if these are legit or if I should be worried?
My current Windows version is:
Édition Windows ...
- 113
0
votes
1
answer
71
views
Connect automatically to wifi as soon as available and if it gets disconnected connect again
My windows 10 disconnects automatically from wifi sometime. My pc is not having monitor i am controlling it over remote desktop team viewer.
Also sometimes running cleanup utilities disable the auto ...
- 1
0
votes
0
answers
76
views
How to show target username in custom event viewer view?
When going to Event Viewer -> Custom View -> My Custom View where I have the following querylist:
<QueryList>
<Query Id="0" Path="Security">
<Select Path=...
- 195
0
votes
0
answers
573
views
What is SWD\WPDBUSENUM\{ID} in Event viewer DriverFrameworks-UserMode?
I was tracing USB connection log with Event Viewer. So usually the log is about USB type device but I found this: The UMDF Host Process ({8d3f38d1-e441-486f-8564-29dd1d6f2c3d}) has been asked to load ...
0
votes
1
answer
390
views
How to extract only Message from the system eventvwr
I am trying to extract only the Message from the system eventvwr for a specific ID, but when i try using the below command i am getting the entire mesaage which is very long to print or send over mail....
- 33
0
votes
1
answer
392
views
How do I locate the actual log and disable events by event id?
Screenshot of event viewer usb event log:
When I right click on other event logs, such as AMSI/Operational, I see the option 'disable/enable' but when I right click on the event log about a usb, ...
- 3
2
votes
2
answers
3k
views
Is it possible to log powershell scripts which executed on my computer?
Title says it all. I already turned on logging via regedit but I want something more stable. I would like to see every commands which executed on powershell to be in my event log just like Sysmon.
- 141
3
votes
1
answer
4k
views
How to decode Kernel-Power Event 566 when waking from sleep
On a Dell Vostro 3470 desktop running Windows-11 Pro 21H2 build 22000.795, while troubleshooting an issue related to waking up from sleep (yes S3 sleep, not Modern Standby, as this platform does not ...
- 45
0
votes
0
answers
22
views
Task Scheduler / Event Viewer - Specifically with Logitech Lightspeed Activity
I'm trying to automate a task. When I want to automate the audio toggle trigger by the headset being turned on or off.
When turned on, I'd like to switch audio input/output to the headset.
When turned ...
1
vote
1
answer
515
views
Windows 10 security mitigations blocking chrome.exe from generating dynamic code
Looking in Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode, I seem to have two programs that consistently appear in here:
steamwebhelper.exe' (...
- 73
0
votes
2
answers
782
views
Remote Desktop installation in Event Viewer - not triggered by me
This issue is for Windows 10 operating in a home environment.
I was looking in Event Viewer for another reason and have found a recurring message that is concerning to me:
Windows Logs -> ...
- 1
0
votes
0
answers
214
views
Windows 10 randomly shutdown and cleared system logs at startup
I have a windows 10 desktop that shutdown unexpectedly. I didn't see it happen but it randomly went offline. When I booted it back up and the first event, per the event logs, was a "log clear&...
- 123
0
votes
1
answer
104
views
How to know if I was working during the day or during the night?
I am working with my computer (Windows 10 Enterprise), sometimes during the day and sometimes during the night. I don't switch off my computer when I go at home.
Is there a way (like in the event ...
- 1,929
2
votes
2
answers
18k
views
How to resolve "server could not bind to the transport \Device\NetBT_Tcpip_<UUID> because another computer on the network has the same name" errors?
What is the meaning of the below event viewer error and how to resolve it?
The server could not bind to the transport
\Device\NetBT_Tcpip_{645D56E9-F6B3-44C1-B7C9-B5A0503A76ED} because
another ...
- 21
0
votes
0
answers
391
views
Does the "PlatformRollbackMethod" Windows Defender event indicate an issue?
For about a month I've been seeing this "PlatformRollbackMethod" in event viewer (Microsoft-Windows-Windows Defender/Operational)
Is this a common event, or an unusual one that might ...
- 87
0
votes
2
answers
606
views
Windows Event Viewer Event Information
I am looking for information on a few specific Windows Event Viewer events that appear to occur on a system that I am using that has unexpected behavior. I can look through the event viewer and save ...
0
votes
0
answers
42
views
What are the "setup" Events in Windows Event Viewer Logging?
I'm getting more familiar with the Windows Event Viewer for a recent IT job, and I'm unsure about what "setup" events are being logged in the Windows Event Viewer.
The MS documentation says ...
- 101
0
votes
1
answer
415
views
Running Program in Windows When Not Connected to Specific Network
I have a Windows 10 PC and a VPN client which does not have a trusted networks feature. I would like to automatically run the client when not connected to my office corporate network or guest WiFi ...
- 1
0
votes
0
answers
44
views
connections such as USB and bluetooth randomly resets at once, and computer randomly powered off once
so i bought a new computer, and is in the process of moving the files. the problem is while the files are being moved from the usb drive to my computer, the progress bar randomly and frequently says ...
4
votes
2
answers
1k
views
Event ID 4723 - An attempt was made to change an account's password. + Event ID 4625
I was going through Event Viewer to track down a software issue and came across these security logs:
Event ID 4723
An attempt was made to change an account's password.
Subject:
Security ID: SYSTEM
...
- 145
2
votes
1
answer
1k
views
Querying event viewer in cmd
Various sources such as this one suggest using a eventquery.vbs on the system to query the event log from cmd. Apparently my stock install of Windows 10 is missing that file:
Microsoft Windows [...
- 23
0
votes
2
answers
188
views
Information missing from Reliabiliy Monitor after windows update
After installing Cumulative Update July 2021 for Windows 10 21H1 KB5004237 I have got the following errors on my computer.
Reliability Monitor doesn't show all the events. The following are missing.
...
- 818
2
votes
0
answers
74
views
Windows AD event to detect new administrator user
I would like to know which event ID can be monitored in order to check if an existing user or a new one become administrator.
I search for 4720 and 4738 event IDs but the information displayed in the ...
- 121
0
votes
1
answer
118
views
Kernel-power CRITICAL on Event Viewer led to PC Shutdown everytime
So i checked my event viewer on why does my PC shuts down by itself,
before shutdown theres a "bbzzzzzzz" sound, its like a sound lags. Then all my display freezes, after a few second, my PC ...
1
vote
2
answers
288
views
User Logon Script - Display additional network information
I have a GPO which runs a PowerShell script on user logon for a particular user.
GPO Location:
This script sends an email whenever the user logs onto the domain, this email contains the computer name ...
- 33
0
votes
1
answer
90
views
Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16)
A Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16)
I am currently scanning my machine, but will Win Defender be able to remove the infection?
Randomly I've been ...
2
votes
0
answers
429
views
Why couldn't I find sysmon events in Event Viewer?
I installed sysmon using the below commmand as documented
sysmon64.exe -accepteula -i
And I can confirm it's running with the command Get-Service Sysmon64 in PowerShell. However I couldn't see ...
- 25.5k
0
votes
1
answer
54
views
Query Security Events in Windows 10
I enabled Object Access auditing on my Windows 10 laptop using the instructions on this page. I then enabled auditing on a file (i.e. Sleep Times.csv). I accessed the file and manually looked ...
- 1,256
0
votes
0
answers
237
views
ErrorCode 87 in Event Viewer
On my Windows 10 sometimes I hear sound indicating that a device that was connected either via USB or Bluetooth was removed but I don't know which device was it and notifications pane doesn't have ...
- 143
0
votes
1
answer
165
views
Is there a way to filter Windows Event Logs by user?
I have my kid using my computer with a separate account and I would like to see all the events triggered by his user account. Is there a way to do this either with the Event Viewer or Powershell?
- 31
-3
votes
2
answers
276
views
Have I been hacked?
I recently received my laptop from repair and I just had a hunch that something fishy might have happened so I checked the log files on Windows Event Viewer and it turns out that my laptop has been ...
- 1
1
vote
0
answers
93
views
Start up items doesent load properly [closed]
Here are my system specs; all new components:
Ryzen 5600x
2x8gb G.Skill Trident Neo Z 3600 16/19/19/39
X570 MSI Tomahawk Wi-Fi (latest BIOS)
Corsair Force Series MP600 Gen. 4
MSI Gaming GeForce RTX ...
- 11
0
votes
0
answers
41
views
How can document bad internet performance frequency over certain time period?
Recently, due to bad quality of internet in my new flat, I tried to figure out to document internet-drops logs over a certain period of time (not asking about when a connection is made or lost, but ...
- 101
2
votes
1
answer
28
views
Does EventViewer have a process I can run directly?
I'm working on foreign language test system and I struggle to find standard Windows Utilities like Event Viewer as they have different names.
Does the Windows Event Viewer have a .exe I can run ...
- 4,976
0
votes
2
answers
207
views
Task scheduler advanced action Filter
I managed to set an action in the Task scheduler that is triggered at the validating of the network setting changes:
by subscribing to events from the register Microsoft-Windows-Diagnostic-Networking/...
1
vote
0
answers
10k
views
What is the cause of this windows Event Error: CbsPackageServicingFailure2
I'm having an issue figuring out what the cause of the error below is. This error is appearing in the windows logs every ten seconds. I'm worried about what could happen to the system with this error ...
0
votes
1
answer
130
views
Kernel Power Failure - Regular and Periodic pattern
My PC is freezing and then rebooting. Event viewer reports a kernel power (event ID: 41).
It happens every 3 days in the evening. Given this periodic pattern, does this help diagnose the issue?
I ...
1
vote
0
answers
124
views
Windows EVTX Delete Via RecordId
I am trying to figure out a way to delete only a single entry (identified via EventRecordID, found in the Details > XML View) from a Windows Log file (.evtx extension).
Tried so far via PowerShell, ...
- 11
1
vote
1
answer
133
views
Audit registry access or modification
I want to audit registry modifications, or attempts in case of failure. For that purpose, I have set the audit policy as follows:
auditpol /set /subcategory:"Registry" /success:enable /...
- 121
0
votes
2
answers
171
views
How do you capture programs/scripts that run and quickly disappear in Windows 10?
I have noticed that a CMD script seems to randomly run while doing things but cannot seem to capture what or where it's coming from. Is there a way to use some sort of logging app to see what comes ...
- 61
3
votes
1
answer
31k
views
How to tell which service or task caused a certain 4624 logon event?
I found a series of Windows logon events 4624 like this:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: mycomputername$
Account Domain: ...
- 301
3
votes
2
answers
522
views
Identify the command run after a UI click
I'm looking for something similar as in here: How to know the corresponding command line cmd for the UI click?
But in my case, under Windows 10 OS.
More specifically, the command run after a UI click ...
- 33