Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [eventviewer]

This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

This tag is for questions about Windows' Event Viewer and Event Logs. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

Event Viewer has three primary logging areas:

  • Application
  • Security
  • System

Recent Versions of Windows (Vista and later / Server 2008 and later) have a large number of additional log areas.

Most Windows components (such as services) log to the System log, with notable exceptions being IIS and user-related operations (such as folder redirection at login) which log to the Application log. Programs that you write should log either to their own log areas or to the Application log. The Security log records successful and failed logins.

See also:

202 questions
1
vote
0 answers

EventLog Windows Event - Why is event #6008 logged even after normal shutdown and restart?

I have been restarting and shutting down the machine through proper steps, ie, using start button, using command line and using Alt+F4. But, shut down event tracker is not logging any events. On windows start-up, EventLog is registering error #6008…
Alok Bhat
  • 11
  • 3
1
vote
0 answers

Outlook on Terminalserver loses connection. Event ID 26

Problem Symptoms: Users experience daily disconnects and reconnects in Outlook running on a Terminal Server and have to log in again. They can not log in instantly but have to wait for approx. 1 minute. What i found out in the Event log: I realized…
Faddi
  • 11
  • 2
1
vote
1 answer

Exporting Account Name, Domain & Timestamp from Security Auditing Event Log

I am currently exporting the last 7 days of Security microsoft windows security auditing logs via powershell to csv. It works, but with way to much detail, and also, not properly formatted. For instance, from the csv, the 'message' cell has this in…
SK2017
  • 113
  • 4
1
vote
1 answer

How to connect from command line to another computer with Event Viewer as another user?

I am trying to connect to another computer with Event Viewer from command line. And it can be done. However, I need to connect as another user (not my logged in user). Is there a way to do that?
AngryHacker
  • 2,877
  • 6
  • 32
  • 33
1
vote
1 answer

Grant access to Event Viewer "Application and Services Logs" via GPO

My monitoring team has requested to be able to read the logs under "Application and Services" in 2008/2012/2016 event viewer. These are the logs that reside in "%SystemRoot%\System32\Winevt\Logs\". Specifically, they're interested in the…
KiltedBuckeye
  • 65
  • 1
  • 5
1
vote
0 answers

What is RDSAppXPlugin?

In windows 2012 event viewer in the "Applications and Services > Microsoft > Windows > TerminalSerices - LocalSessionManager > Operational" path I can see the following event: "Plugin RDSAppXPlugin has been successfully initialized" Any idea what is…
Amin
  • 79
  • 1
  • 2
  • 5
1
vote
2 answers

Adding an eventlog to an existing Windows Log

I have the following Event Log: This Event Log only appears inside Custom Views -> Server Roles -> Remote Desktop Services. What I'd like to do is add it to Windows Logs -> Security as I already have an agent that's crawling this folder. Is that…
JustAGuy
  • 639
  • 3
  • 23
  • 38
1
vote
1 answer

Local PC Event Viewer not logging account creation/deletion

I have a GPO that is setting audit account management success/failure on a windows 7 workstation. RSOP User Acc is created Any idea what could be causing this issue with logging events?
Kenta
  • 121
  • 4
1
vote
1 answer

How to log the events about the client boot from any live disks in windows server?

Are there any ways to find out whether any clients boot from a live disk for example Active Boot Disk? How to log that into windows server events log? Thanks in advanced. Server: Windows Server 2012. Clients' OS: Windows 7.
Arani
  • 326
  • 3
  • 20
1
vote
3 answers

WEF collect Windows Defender logs from clients on Windows Server 2012 R2

I'm trying to set up Windows Event Forwarding on a Windows 2012 R2 collector server. I was looking to collect events from Windows Defender, which comes by default on Windows 7 and 8 clients. I know that Windows Defender is not supported by Microsoft…
frederict
  • 11
  • 4
1
vote
0 answers

Windows 2012 RDS Server logon causes Audit Failure 4625

We have a Windows 2012 R2 RDS server and a Windows 2008 R2 Domain Controller. Every time a user logs on or off of the RDS server, It logs event 4771 audit failure incorrect username or password for the machine account of the RDS server on the DC. …
Craig Garnham
  • 21
  • 5
1
vote
1 answer

Did anyone get their Tandberg RDXmon service installed incorrectly or is it meant to be that way?

We have several "RDX" USB cartridge drives on customers' sites. Normally they don't log anything to the Windows event logs. This changes after you install the optional "RDX Tools". After the installation you start seeing entries in the "Application"…
StackzOfZtuff
  • 1,842
  • 13
  • 21
1
vote
1 answer

Windows Domain accounts gets locked without any failed logon events

I have a domain account which keeps getting locked without any prior wrong password login attempts: I.e (completely stripped off the details, just to give you an idea) 10:15:49 - logon successful 10:16:55 - logon failed (account locked) There's…
user2629636
  • 774
  • 5
  • 19
  • 40
1
vote
1 answer

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event logs from various servers. I have setup the Event…
Mike
  • 11
  • 4
1
vote
1 answer

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only possible to use Group Policy in order to either archive…
JustAGuy
  • 639
  • 3
  • 23
  • 38
1 2 3
…
13 14