Questions tagged [event-viewer]

Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.

Filter by
Sorted by
Tagged with
3
votes
0answers
13 views

Windows AD event to detect new administrator user

I would like to know which event ID can be monitored in order to check if an existing user or a new one become administrator. I search for 4720 and 4738 event IDs but the information displayed in the ...
0
votes
1answer
22 views

Kernel-power CRITICAL on Event Viewer led to PC Shutdown everytime

So i checked my event viewer on why does my PC shuts down by itself, before shutdown theres a "bbzzzzzzz" sound, its like a sound lags. Then all my display freezes, after a few second, my PC ...
1
vote
2answers
64 views

User Logon Script - Display additional network information

I have a GPO which runs a PowerShell script on user logon for a particular user. GPO Location: This script sends an email whenever the user logs onto the domain, this email contains the computer name ...
0
votes
1answer
54 views

Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16)

A Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16) I am currently scanning my machine, but will Win Defender be able to remove the infection? Randomly I've been ...
2
votes
0answers
24 views

Why couldn't I find sysmon events in Event Viewer?

I installed sysmon using the below commmand as documented sysmon64.exe -accepteula -i And I can confirm it's running with the command Get-Service Sysmon64 in PowerShell. However I couldn't see ...
0
votes
1answer
14 views

Query Security Events in Windows 10

I enabled Object Access auditing on my Windows 10 laptop using the instructions on this page. I then enabled auditing on a file (i.e. Sleep Times.csv). I accessed the file and manually looked ...
0
votes
0answers
54 views

ErrorCode 87 in Event Viewer

On my Windows 10 sometimes I hear sound indicating that a device that was connected either via USB or Bluetooth was removed but I don't know which device was it and notifications pane doesn't have ...
0
votes
0answers
17 views

Process Exit Monitor - Event ID 3000 - Process Exit code 3

One of our user was facing an unusual termination of our software. From software logs we could get to know that Software was working without any error and all of sudden it just disappeared (logs has ...
0
votes
1answer
33 views

Is there a way to filter Windows Event Logs by user?

I have my kid using my computer with a separate account and I would like to see all the events triggered by his user account. Is there a way to do this either with the Event Viewer or Powershell?
-3
votes
2answers
125 views

Have I been hacked?

I recently received my laptop from repair and I just had a hunch that something fishy might have happened so I checked the log files on Windows Event Viewer and it turns out that my laptop has been ...
0
votes
0answers
13 views

Tools softwares to capture sort filter windows event logs and windows error logs?

As in my office there are 60 desktop pc of amd Ryzen 7 2700x 3700x 3800x with b450 x470 x570 b550 asus gigabyte MSI motherboards all have UEFI BIOS and RTX 3070 RTX 3090 RTX 2080ti graphic cards with ...
1
vote
0answers
72 views

Start up items doesent load properly [closed]

Here are my system specs; all new components: Ryzen 5600x 2x8gb G.Skill Trident Neo Z 3600 16/19/19/39 X570 MSI Tomahawk Wi-Fi (latest BIOS) Corsair Force Series MP600 Gen. 4 MSI Gaming GeForce RTX ...
0
votes
0answers
28 views

How can document bad internet performance frequency over certain time period?

Recently, due to bad quality of internet in my new flat, I tried to figure out to document internet-drops logs over a certain period of time (not asking about when a connection is made or lost, but ...
2
votes
1answer
21 views

Does EventViewer have a process I can run directly?

I'm working on foreign language test system and I struggle to find standard Windows Utilities like Event Viewer as they have different names. Does the Windows Event Viewer have a .exe I can run ...
0
votes
2answers
34 views

Task scheduler advanced action Filter

I managed to set an action in the Task scheduler that is triggered at the validating of the network setting changes: by subscribing to events from the register Microsoft-Windows-Diagnostic-Networking/...
0
votes
0answers
2k views

What is the cause of this windows Event Error: CbsPackageServicingFailure2

I'm having an issue figuring out what the cause of the error below is. This error is appearing in the windows logs every ten seconds. I'm worried about what could happen to the system with this error ...
0
votes
1answer
60 views

Kernel Power Failure - Regular and Periodic pattern

My PC is freezing and then rebooting. Event viewer reports a kernel power (event ID: 41). It happens every 3 days in the evening. Given this periodic pattern, does this help diagnose the issue? I ...
1
vote
0answers
34 views

Windows EVTX Delete Via RecordId

I am trying to figure out a way to delete only a single entry (identified via EventRecordID, found in the Details > XML View) from a Windows Log file (.evtx extension). Tried so far via PowerShell, ...
0
votes
0answers
15 views

Power Events: “state: active” is not logged

powercfg /sleepstudy Generates only logs for when computer goes into "state: standby" But when i wake the computer after it goes into "state: standby" i would expect a "state:...
1
vote
1answer
33 views

Audit registry access or modification

I want to audit registry modifications, or attempts in case of failure. For that purpose, I have set the audit policy as follows: auditpol /set /subcategory:"Registry" /success:enable /...
0
votes
0answers
8 views

How to see that an application (e.g. notepad) is launched at a certain point in time on Event Viewer in Windows 10? [duplicate]

I looked at "Windows log > Application" and "Windows log > Security". In both cases, I can not find any processes that indicating that the notepad was just launched by me. ...
0
votes
2answers
79 views

How do you capture programs/scripts that run and quickly disappear in Windows 10?

I have noticed that a CMD script seems to randomly run while doing things but cannot seem to capture what or where it's coming from. Is there a way to use some sort of logging app to see what comes ...
-1
votes
1answer
4k views

How to tell which service or task caused a certain 4624 logon event?

I found a series of Windows logon events 4624 like this: An account was successfully logged on. Subject: Security ID: SYSTEM Account Name: mycomputername$ Account Domain: ...
2
votes
2answers
55 views

Identify the command run after a UI click

I'm looking for something similar as in here: How to know the corresponding command line cmd for the UI click? But in my case, under Windows 10 OS. More specifically, the command run after a UI click ...
0
votes
0answers
33 views

AD Account are being locked but only some are showing as 4740 in Domain controller

We have been seeing increasing number of AD Account lockouts. Some of these lockouts show up in event viewer as 4740 events but most do not show up at all. My account has been locked out almost once ...
0
votes
0answers
185 views

Please help me figuring out the these mysterious event IDs

Every time I login into my personal computer, I see an event ID 4723 with the following: An attempt was made to change an account's password. Subject: Security ID: SYSTEM Account ...
1
vote
0answers
101 views

Computer freezing, lagging and crashing randomly

My 3 year old computer is recently crashing multiple times each day with no tracable sources. It happens randomly; when gaming, watching videos or even idling... The temperature is of the CPU is fine. ...
1
vote
0answers
217 views

detect USB C/ Thunderbolt 3 connection in event viewer?

I have recently made a simple PowerShell script that upon connection of a PnP device checks whether a "razer naga" mouse is connected and runs the synapse software. Upon disconnection of the device, ...
0
votes
1answer
258 views

WMI Service Host using a high amount, 10-20% CPU a lot of the time

On my Windows 10 laptop, the application WMI Service Host is using a considerable amount of CPU time and spinning the fans up. This is not normal operation. WMI should be called somewhat rarely. I can'...
1
vote
2answers
2k views

What time zone does windows event logs show

I have a doubt on the time zone shown in the windows event logs. I had read that if I export the windows event logs from another machine and open it in my machine which has a different time zone, the ...
1
vote
1answer
247 views

How to log Custom Views in Event Viewer (Windows Server 2012 )

I created a Custom View in Event Viewer (Windows Server 2012) that displays events from by a specified source (Sugar2SvcNow Log in attached screen shot). I'm trying to save all the events in this ...
0
votes
2answers
1k views

How to determine the reason for Windows spontaneous shutdown?

Update 2: Tracking the reasons for a few shutdowns in the past couple of weeks, using the Event Viewer without filtering events, to get to the approximate time of shutdown, it seems like the last few ...
0
votes
0answers
142 views

Event external display

Does anyone know which event and event ID is triggered when an external monitor is connected and disconnected? I can't seem to found an answer online. What I would like to use it for is when the ...
0
votes
1answer
61 views

How to determine when the pc turns on windows 10?

I want to know when my PC turns on or off. Is there a way to know this? I have admin rights.
3
votes
0answers
294 views

34 GB of commited memory but no app actually commited that much

Sometimes I encounter Out of memory errors and Windows Event Viewer shows this (translated): Resource-Exhaustion-Detector: A lack of virtual memory in the system was successfully detected. The ...
1
vote
0answers
18 views

HP ProBook instant shutdown after first logon the day

Every morning my notebook is shutting itself instantly after the first logon with win hello. There is nothing obvious written to the event log. All the following application event raised through the ...
0
votes
0answers
240 views

Why Won't Event Viewer, System Information, System Configuration apps launch off the Start menu on my Windows 2016 Server on Azure?

It seems I cannot start Event Viewer, System Information, and System Configuration when I click the Start menu and start typing in their names to search for them; clicking their icons when they appear ...
0
votes
1answer
55 views

Windows Application event logs stooped logging

I am encountered with an issue with the event viewer. The issue is that new application event logs are not logging in the file(archive). And if I try manually generate an error log in "application" it ...
0
votes
1answer
342 views

How can I track successful logins and disconnects?

I am trying to track every time a user remotes into a computer and every time they disconnect. I am using Powershell to do this. This is what I am using to do this Get-WinEvent -Computer $env:...
1
vote
0answers
43 views

Windows 7 Event Viewer - Save logs in real-time

I recently changed event viewer to save logs to an external drive then restarted my computer. It's working fine, however, the logs aren't being written in real time. When I open Event Viewer, it ...
0
votes
0answers
103 views

Can't access Event Viewer logs after a BSOD

I hope this is an okay place to ask this. My issue is fairly similar to this StackOverflow post that was closed and directed to SuperUser. However, I'm on Windows 10 and the hotfix, even if ...
0
votes
0answers
323 views

Powershell Get-winevent “The request is not supported” Error

I'm trying to read an evtx event file generated by wusa but Get-WinEvent is just throwing an error. PS> Get-WinEvent -path .\install.evtx Get-WinEvent : The request is not supported At line:1 char:...
1
vote
0answers
967 views

How to remove permanently custom view from EventViewer?

I have created a custom view in Event Viewer. I deleted the custom view from Event Viewer, the custom view disappear, then I launched Event Viewer again but the custom view reappeared. Windows 10 ...
1
vote
0answers
65 views

Disabled Local Policies:Audit Policy, but Event Viewer is still displaying Security Logs

I disabled all types of auditing for both successes and failures in: Local Security Policy > Local Policies > Audit Policy but when I go to Event Viewer > Windows Logs > Security, logs are still ...
0
votes
1answer
87 views

Does the time change on thin clients to sync up to what application say the time is?

I know this question is not put the best way and I can edit it to read better after I have a better understanding of this. We are using a Windows 10 Enterprise environment that is VMI and VDI based. ...
1
vote
2answers
3k views

The IO operation at logical block was retried and CRC errors in S.M.A.R.T

I have a Samsung 850 Evo (250GB) SSD since December 2016 (2+years). In February this year my system started to lag and while digging in Event Viewer I saw Event 153 + CRC error count in SMART go up. ...
0
votes
1answer
456 views

Does Windows EventLog drops off old items as new items are added?

Does the Windows EventLog automagically truncate or drop off items ? (Windows 10 Pro). Refer to my screenshot. First item shown is 15/3/2019 at 7:32:12 PM When i first looked at the log I am ...
0
votes
1answer
256 views

How to Remove a task from Event Viewer

Just attached a task to a security (Event Viewer > Windows Logs > Security) event on Event Viewer, but now it seems not possible to change it or even remove it. Does anyone knows where it could be? ...
0
votes
0answers
196 views

Windows 10 Event Viewer: Asks for disk check on non-existing volume

When checking the event viewer, Windows will log the following error: Volume \?\Volume{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} {\Device\0000003f} needs to be taken offline for a short period to ...
0
votes
0answers
716 views

Memory exhaustion with apparently no process exhausting it

I am suffering memory exhaustions on a Windows 10 computer nearly every three days, with no pattern to reproduce (sometimes after PC is powered on for days, sometimes just after power on, sometimes ...