Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [event-viewer]

Windows Event Viewer is a utility that shows users logs of events generated by the Windows operating system, and applications/services running on Windows.

Filter by
Sorted by
Tagged with
0 votes
1 answer
51 views

windows 11 error The Secure Boot update failed

for some reason this error is constantly thrown and logged in the Windows Event Viewer: The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this ...
Semen Shekhovtsov's user avatar
0 votes
0 answers
10 views

How to configure AlientVault OSSIM to collect Windows security event logs and send email

I'm completely new to AlienVault OSSIM and I want to start using OSSIM to collect Windows security events from domain controllers e.g. failed login attempts, bad password attempts, account lockouts, ...
Spacewalker's user avatar
0 votes
0 answers
42 views

Windows Event Viewer not Logging more than a day log - Application Logs

Application log is not retaining more than a day worth of logs. I have SQL Server 2019 installed and other DW application. I tried to restart the Windows event log service and also the server as well. ...
WhoIsNotActive's user avatar
1 vote
0 answers
39 views

HyperV VM was stopped - How to find why and when in Windows Server event logs

Recently I keep finding a HyperV VM (the MSSP's vulnerability scanner) that is in the "Stopped" state when it shouldn't be and want to find the cause. I'm a support officer slowly ...
cyprxn's user avatar
  • 11
0 votes
0 answers
28 views

Windows Event IDs to Monitor Logins, Unlocks, Startups

I'm trying to query the Windows 11 event log for any use of a computer. I'm starting with someone getting access to the Windows UI, so I've tried this query I found somewhere on ServerFault, but the ...
ProfK's user avatar
  • 2,641
0 votes
1 answer
416 views

Strange events in windows 10 event log regarding the Windows Modules installer service

I was just looking through my event viewer because I have a device that keeps disconnecting and reconnecting, so I was trying to find out if it was a software issue, or if maybe a wire in a USB cable ...
greenops011's user avatar
0 votes
1 answer
366 views

Windows 11 PC waking up from hibernation with unknown wake reason

This problem has been driving me mad for the past few months. Almost every time I put my computer into hibernation mode for the night it immediately boots back up. After a few times, it will ...
luftwaffle's user avatar
1 vote
0 answers
167 views

Filter Windows Event Viewer based on information inside the event itself

I have a large number of events like: Category: Microsoft.EntityFrameworkCore.Database.Command EventId: 20101 Executed DbCommand (2ms) [Parameters=[], CommandType='Text', CommandTimeout='30'] SELECT ...
EJoshuaS - Stand with Ukraine's user avatar
0 votes
0 answers
33 views

Network adapter identification from WLAN disconnect event

Want to attach specific task to wifi adapter disconnect event, but need (just disconnected) adapter identification (name, guid, etc..). Unfortunatelly its not present in generated 4004 event. There ...
user2956477's user avatar
0 votes
1 answer
138 views

Is there a way to find out when my external hard drive was unplugged?

My two external hard drives were manually unplugged from my Windows 10 laptop last night, presumably by my roommate, either that or I'm losing my mind/sleepwalking. I'm really curious and I searched ...
tonyd1234's user avatar
0 votes
1 answer
268 views

Triggering a scheduled task using process ID (Windows 10)

How can I trigger a task in the Task Scheduler using a process ID that I get from the Task Manager? Sort of similiar to the event ID from the Event Viewer. My first solution was to use the event ID ...
Bedito's user avatar
  • 1
0 votes
0 answers
17 views

Is it possible to create different log files policies for different events?

I am using windows server 21H2 to audit the access to a folder, files and subfolders. If in event viewer I right click in security and go to properties, I can configure the size of the event files and ...
Álvaro García's user avatar
1 vote
1 answer
426 views

I lost events in events viewer, or how to see all the events?

The OS is Windows Server 21H2. I have enabled folders and files access auditing and in the Windows events viewer. I filter by the 5663 event. I can see the events. However, for example, if I have an ...
Álvaro García's user avatar
0 votes
0 answers
159 views

Very high ram usage, used by tag EtwD and Etwr

Ever since I received my laptop I have been running out of RAM randomly (usually while gaming). After extensive monitoring I was able to identify that the Tag ETwD and Etwr in poolmon are the cause of ...
Steven10172's user avatar
1 vote
1 answer
481 views

Parsing repeated Logon and Logoff events for users on Domain Controller to produce single logon and logoff in a report

Task I have a domain controller running on Windows Server 2016. The Event Viewer shows events with ID's 4624 and 4634 every time a user logs on or off with a domain user account. (...maybe, the events ...
Flash_Steel's user avatar
2 votes
1 answer
2k views

Any way to see in EventViewer if a Windows logon was made using password Vs. fingerprint?

I suspect someone logged on to my computer (windows 10) (this is someone I know who might have access to my password), I see so many logons that I can't be sure which were mine, but what I do know is ...
momo034's user avatar
  • 21
0 votes
1 answer
88 views

EventViewer: Custom view Ok button grayed out

I am trying to create a Custom View by Source in Event Viewer. But when I do this, the OK button is grayed out. Does anyone know how to solve this? I am using Windows 10, and the Event Viewer is run ...
Tom Bennett's user avatar
0 votes
1 answer
611 views

Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?

Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
cursor arrows's user avatar
0 votes
1 answer
310 views

Need permissions to delete event log

I have an application that I wanted to delete but when I tried doing so, it said that it couldn't be deleted because was open in the event log. Since I didn't want to do it manually, I found this ...
skloggy's user avatar
1 vote
0 answers
47 views

A Slack message was sent out during the time when Eventviewer logs show the computer was on sleep mode. Is it possible?

Could anyone please advise me? Using my computer, a Slack message was sent out at the time stamped during the time when Event viewer logs show the computer was on sleep mode. Is it possible? If it ...
Shigetake's user avatar
2 votes
0 answers
4k views

Windows Event Viewer ID for when certificate is installed

Is there any where in Windows Event Viewer that can show when a new certificate is installed on user or machine certificate stores? All I found is this: https://social.technet.microsoft.com/wiki/...
user avatar
1 vote
0 answers
182 views

Troubleshooting Windows Event Viewer USB error 0x26 status 0xc000038e [closed]

I need some guidance in how to troubleshoot a low level issue I am facing with some USB devices. Background: I have a .NET Windows Service that, scans connected USB devices via WMI queries + reads low ...
Veverke's user avatar
  • 177
0 votes
2 answers
81 views

Weird folders in event viewer. Can't tell if they’re legit or something else [duplicate]

The Microsoft folders in my event viewer looks weird, I do not know how to describe this better Any idea if these are legit or if I should be worried? My current Windows version is: Édition Windows ...
Maxime's user avatar
  • 125
0 votes
1 answer
318 views

Connect automatically to wifi as soon as available and if it gets disconnected connect again

My windows 10 disconnects automatically from wifi sometime. My pc is not having monitor i am controlling it over remote desktop team viewer. Also sometimes running cleanup utilities disable the auto ...
raja's user avatar
  • 1
0 votes
0 answers
2k views

What is SWD\WPDBUSENUM\{ID} in Event viewer DriverFrameworks-UserMode?

I was tracing USB connection log with Event Viewer. So usually the log is about USB type device but I found this: The UMDF Host Process ({8d3f38d1-e441-486f-8564-29dd1d6f2c3d}) has been asked to load ...
ERC-1155 man's user avatar
0 votes
1 answer
1k views

How to extract only Message from the system eventvwr

I am trying to extract only the Message from the system eventvwr for a specific ID, but when i try using the below command i am getting the entire mesaage which is very long to print or send over mail....
chandu's user avatar
  • 53
0 votes
1 answer
1k views

How do I locate the actual log and disable events by event id?

Screenshot of event viewer usb event log: When I right click on other event logs, such as AMSI/Operational, I see the option 'disable/enable' but when I right click on the event log about a usb, ...
rasputin's user avatar
2 votes
2 answers
9k views

Is it possible to log powershell scripts which executed on my computer?

Title says it all. I already turned on logging via regedit but I want something more stable. I would like to see every commands which executed on powershell to be in my event log just like Sysmon.
Cute Bear's user avatar
  • 141
6 votes
0 answers
12k views

How to decode Kernel-Power Event 566 when waking from sleep

On a Dell Vostro 3470 desktop running Windows-11 Pro 21H2 build 22000.795, while troubleshooting an issue related to waking up from sleep (yes S3 sleep, not Modern Standby, as this platform does not ...
Charlie's user avatar
  • 75
0 votes
0 answers
32 views

Task Scheduler / Event Viewer - Specifically with Logitech Lightspeed Activity

I'm trying to automate a task. When I want to automate the audio toggle trigger by the headset being turned on or off. When turned on, I'd like to switch audio input/output to the headset. When turned ...
Chris Choi's user avatar
1 vote
1 answer
1k views

Windows 10 security mitigations blocking chrome.exe from generating dynamic code

Looking in Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode, I seem to have two programs that consistently appear in here: steamwebhelper.exe' (...
GaussStrife's user avatar
0 votes
2 answers
2k views

Remote Desktop installation in Event Viewer - not triggered by me

This issue is for Windows 10 operating in a home environment. I was looking in Event Viewer for another reason and have found a recurring message that is concerning to me: Windows Logs -> ...
JSwish's user avatar
  • 1
0 votes
0 answers
451 views

Windows 10 randomly shutdown and cleared system logs at startup

I have a windows 10 desktop that shutdown unexpectedly. I didn't see it happen but it randomly went offline. When I booted it back up and the first event, per the event logs, was a "log clear&...
The Shoe Shiner's user avatar
0 votes
1 answer
262 views

How to know if I was working during the day or during the night?

I am working with my computer (Windows 10 Enterprise), sometimes during the day and sometimes during the night. I don't switch off my computer when I go at home. Is there a way (like in the event ...
Dominique's user avatar
  • 2,249
2 votes
2 answers
23k views

How to resolve "server could not bind to the transport \Device\NetBT_Tcpip_<UUID> because another computer on the network has the same name" errors?

What is the meaning of the below event viewer error and how to resolve it? The server could not bind to the transport \Device\NetBT_Tcpip_{645D56E9-F6B3-44C1-B7C9-B5A0503A76ED} because another ...
whattodo's user avatar
0 votes
0 answers
481 views

Does the "PlatformRollbackMethod" Windows Defender event indicate an issue?

For about a month I've been seeing this "PlatformRollbackMethod" in event viewer (Microsoft-Windows-Windows Defender/Operational) Is this a common event, or an unusual one that might ...
Eric's user avatar
  • 87
0 votes
2 answers
2k views

Windows Event Viewer Event Information

I am looking for information on a few specific Windows Event Viewer events that appear to occur on a system that I am using that has unexpected behavior. I can look through the event viewer and save ...
snowmanemperor's user avatar
0 votes
0 answers
154 views

What are the "setup" Events in Windows Event Viewer Logging?

I'm getting more familiar with the Windows Event Viewer for a recent IT job, and I'm unsure about what "setup" events are being logged in the Windows Event Viewer. The MS documentation says ...
Theodore Steiner's user avatar
0 votes
1 answer
937 views

Running Program in Windows When Not Connected to Specific Network

I have a Windows 10 PC and a VPN client which does not have a trusted networks feature. I would like to automatically run the client when not connected to my office corporate network or guest WiFi ...
RossHDB's user avatar
0 votes
0 answers
56 views

connections such as USB and bluetooth randomly resets at once, and computer randomly powered off once

so i bought a new computer, and is in the process of moving the files. the problem is while the files are being moved from the usb drive to my computer, the progress bar randomly and frequently says ...
programmer3481's user avatar
4 votes
2 answers
2k views

Event ID 4723 - An attempt was made to change an account's password. + Event ID 4625

I was going through Event Viewer to track down a software issue and came across these security logs: Event ID 4723 An attempt was made to change an account's password. Subject: Security ID: SYSTEM ...
Iansen's user avatar
  • 145
2 votes
1 answer
3k views

Querying event viewer in cmd

Various sources such as this one suggest using a eventquery.vbs on the system to query the event log from cmd. Apparently my stock install of Windows 10 is missing that file: Microsoft Windows [...
user1476716's user avatar
0 votes
2 answers
323 views

Information missing from Reliabiliy Monitor after windows update

After installing Cumulative Update July 2021 for Windows 10 21H1 KB5004237 I have got the following errors on my computer. Reliability Monitor doesn't show all the events. The following are missing. ...
desbest's user avatar
  • 938
2 votes
0 answers
280 views

Windows AD event to detect new administrator user

I would like to know which event ID can be monitored in order to check if an existing user or a new one become administrator. I search for 4720 and 4738 event IDs but the information displayed in the ...
Miguel.G's user avatar
  • 121
0 votes
1 answer
287 views

Kernel-power CRITICAL on Event Viewer led to PC Shutdown everytime

So i checked my event viewer on why does my PC shuts down by itself, before shutdown theres a "bbzzzzzzz" sound, its like a sound lags. Then all my display freezes, after a few second, my PC ...
Fernaldy Wiranata's user avatar
1 vote
2 answers
571 views

User Logon Script - Display additional network information

I have a GPO which runs a PowerShell script on user logon for a particular user. GPO Location: This script sends an email whenever the user logs onto the domain, this email contains the computer name ...
S_T's user avatar
  • 33
0 votes
1 answer
108 views

Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16)

A Possible detection of CVE: 2021-04-23 logged in event viewer (23/04/2021 @15:54:16) I am currently scanning my machine, but will Win Defender be able to remove the infection? Randomly I've been ...
Simple-IT's user avatar
2 votes
0 answers
2k views

Why couldn't I find sysmon events in Event Viewer?

I installed sysmon using the below commmand as documented sysmon64.exe -accepteula -i And I can confirm it's running with the command Get-Service Sysmon64 in PowerShell. However I couldn't see ...
phuclv's user avatar
  • 28k
0 votes
1 answer
99 views

Query Security Events in Windows 10

I enabled Object Access auditing on my Windows 10 laptop using the instructions on this page. I then enabled auditing on a file (i.e. Sleep Times.csv). I accessed the file and manually looked ...
Nathan's user avatar
  • 1,306
0 votes
0 answers
626 views

ErrorCode 87 in Event Viewer

On my Windows 10 sometimes I hear sound indicating that a device that was connected either via USB or Bluetooth was removed but I don't know which device was it and notifications pane doesn't have ...
sebastian_t's user avatar

1
2 3 4 5