Full security log in Event Viewer

Similar Questions

• Opening of anonymous logon Type 3 in Event Viewer Security log

  I am running Windows 7 Professional, all Windows updates current and Kaspersky Internet Security installed.

  I have reviewed the security logs in Event Viewer and have noticed many cases of successful NULL SID LOGON Type 3 ANONYMOUS logons.

  Log name: security
  Source: Microsoft-Windows-security-auditing
  Date: 16/02/2015 14:16:48
  Event ID: 4624
  Task category: logon
  Level: Information
  Keywords: Audit success
  User: n/a
  Computer: PC
  Description:
  An account has been connected successfully.

  Object:
  Security ID: NULL SID
  Account name: -.
  Account domain: -.
  Logon ID: 0x0

  Logon type: 3

  New logon:
  Security ID: ANONYMOUS logon
  Account name: ANONYMOUS logon
  Account domain: NT AUTHORITY
  Login ID: 0x1dd9a
  Logon GUID: {00000000-0000-0000-0000-000000000000}

  Process information:
  Process ID: 0 x 0
  Process name: -.

  Network information:
  Name of the workstation:
  Source network address: -.
  Source port: -.

  Detailed authentication information:
  Logon process: NtLmSsp
  Authentication package: NTLM
  Transited Services: -.
  Package Name (NTLM only): NTLM V1
  Key length: 0

  
     
      4624
      0
      0
      12544
      0
      0 x 8020000000000000
     
      40400
     
     
      Security
      PC
     
   
   
      S 1-0-0
      -
      -
      0 x 0
      S-1-5-7
      ANONYMOUS LOGON
      NT AUTHORITY
      0x1dd9a
      3
      NtLmSsp
      NTLM
     
     
      {00000000-0000-0000-0000-000000000000}
      -
      NTLM V1
      0
      0 x 0
      -
      -
      -
   
  

  It's me serious concern. This means that an unauthorized user has installed access remote asteroid Trojan or malware on my system? How can I fix this and prevent subsequent instances of what's going on? Thank you for your contribution to this issue.

  Hi Patrick,

  Thanks for posting your query in Microsoft Community.

  According to the description, it seems to be a problem with the remote of a web of computer resource access as it is connected to internet or malware/virus infection.

  I suggest you scan your computer with the Microsoft Security Scanner, which would help us to get rid of viruses, spyware and other malicious software.

  The Microsoft Security Scanner is a downloadable security tool for free which allows analysis at the application and helps remove viruses, spyware and other malware. It works with your current antivirus software.
  http://www.Microsoft.com/security/scanner/en-us/default.aspx

  Note: The Microsoft Safety Scanner ends 10 days after being downloaded. To restart a scan with the latest definitions of anti-malware, download and run the Microsoft Safety Scanner again.

  Important: While running scan on the hard drive if bad sectors are found on the hard drive when scanning try to repair this area if all available on which data may be lost.

  Hope this information is useful. Let us know if you need more help, we will be happy to help you.

• Event Viewer: shows security logon access that never happened

  co-worker noticed any access unauthorized to the sound system by looking at its security log in Event Viewer when the accused only used the accusers shared printer to print.  The security log indicates that the user is connected both with the login name and domain and user of machine references.  What would cause this?

  If the printer is shared from the local computer, a remote computer user will naturally have to access. MS - MVP - Elephant Boy computers - don't panic!

• What is the 528 event in the security event viewer in Windows XP Home Edition?

  What is the 528 event in the security event viewer in Windows XP Home Edition?

  Hello

  Are you facing problems with your computer?

  Check out the link for details about event ID: 528

  http://www.Microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+operating+system&ProdVer=5.0&EvtID=528&EvtSrc=security

  For reference:

  Procedure to view and manage event logs in Event Viewer in Windows XP

  http://support.Microsoft.com/kb/308427

• What is F-Secure goalkeeper? I found it in Event Viewer with the error

  On one of the computers I tried, I think I can get rid of some hackers or hacker, I found this F-Secure Gatekeeper in Event Viewer and they were all in front of them of the error.   We buy this software, so I don't know why it is in the event viewer.

  Hello

  • What is the full error message that you receive in the event viewer (http://support.microsoft.com/kb/308427)?
  • You the computer to the domain?
   
  F-Secure Internet Gatekeeper is a suite of real-time services to protect against computer viruses and malicious code coming business network in the web (HTTP and FTP over HTTP) and e-mail (SMTP) traffic.
   
  If you do not have any Antivirus installed, you can install Microsoft essential Security on the computer.
  Here is the link:
  http://www.Microsoft.com/security/scanner/en-us/default.aspx 
   
  See also:
  http://www.Microsoft.com/resources/documentation/Windows/XP/all/proddocs/en-us/security_ht_comp.mspx?mfr=true

   

  http://www.Microsoft.com/security/PC-security/spyware-prevent.aspx

• How to remove bad Event Viewer logs?

  I have a lot of newspapers uncomepleted like google earth when the download is comepleted he'll say something wrong when you download try again and every time I do alright on your Observer newspaper events and as a warning I not his mess up my computer thats why im tryin to c, if I can remove warnings , what will happen, thank you

  * original title - can u remove the wrong logs in Event Viewer that is alert *.

  Hi jb1961,

  One entry warning, error or information in your event log do not "mess up your computer", but it takes place and so continually underway, makes it harder to see the other topics.  So also fills the space of Event Viewer so that the replacement of the older entries occurs earlier than she is otherwise perhaps - but in general there is a lot of space so fixed at default levels.  Incomplete newspapers in the example you used are also too much space, but it's better another question, addressed through the support of Google Earth web site or forums.

  You cannot remove specific entries from logs in the event viewer, but you can filter the events.  As I don't know what OS you use, I'll provide procedures for XP, Vista and W7.

  For XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/nt_filteringevents_how_ev.mspx?mfr=true.

  For Vista and W7: http://technet.microsoft.com/en-us/library/cc722058.aspx.

  *****************************************************

  To completely clear the event logs, follow these instructions (but it's the whole journal, not only an entry application or event - so I don't think that's what you want): http://www.ehow.com/how_5886147_delete-entries-windows-event-log.html.

  How to delete a specific entry from the event logs: http://www.ehow.com/how_6039004_remove-entry-event-viewer.html.  NOTE: I am note quite sure this removes only the entries that were held (does so must it be restored) or prevents also any future entries like this - so be careful before to do this and make sure that you are aware of the possible consequences (see again this entry).  A possible workaround might be to first copy the entry elsewhere, delete it the registry then, restore the entry in the registry and who can delete past events but allowed future events always appear (or it can restore once restored previous events and so unnecessary - I am not sure).  Before you do, if you do, don't forget to back up the registry (the section you are working on the use: the entire thing using http://windowsxp.mvps.org/registry.htmor http://support.microsoft.com/kb/136393 ) and I would also create a system restore point just to be safe.  , But before I did (which I think is unnecessary and just a little risky), I would use the above filter process.

  pe I hoit helps.

  Good luck!

• Question about consistent errors in the event viewer XP Home Edition

  I ran a program called VEW looking errors up to twenty in the XP Event Viewer.

  Here is the data for the analysis of files:

  V01c Vino event viewer run on Windows XP in English
  Report run at 28/01/2012 23:42:23

  Note: All dates below are in the format dd/mm/yyyy

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  "System" Log - error Type
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Journal: "System" Date/time: 01/28/2012 22:48:06
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: "System" Date/time: 01/28/2012 22:47:40
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 01/28/2012 22:35:31
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 27/01/2012-22:49:54
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: "System" Date/time: 27/01/2012-22:37:21
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 27/01/2012-14:32:57
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 27/01/2012 03:38:23
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 25/01/2012-13:53:36
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: "System" Date/time: 25/01/2012-13:32:34
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 24/01/2012 23:35:59
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: "System" Date/time: 24/01/2012 23:21:10
  Type: error category: 0
  Event: 29 Source: W32Time
  The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible.  No attempt to contact a source will be for 14 minutes. NtpClient has no source of accurate time.

  Journal: "System" Date/time: 24/01/2012 23:21:10
  Type: error category: 0
  Event: 17 Source: W32Time
  Time provider NtpClient: an error has occurred during the DNS lookup of the manually configured peer 'time.nist.gov, 0x1 '. NtpClient will try the DNS lookup in 15 minutes. The error was: a socket operation was attempted to an unreachable host. (0 x 80072751)

  Journal: "System" Date/time: 24/01/2012 23:18:36
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 24/01/2012 02:15:46
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 24/01/2012-12:58:29 AM
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: "System" Date/time: 24/01/2012 00 h delighteth
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: 'System' time: 23/01/2012 23:26:32
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: 'System' time: 23/01/2012 23:26:19
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: 'System' time: 23/01/2012 23:02:41
  Type: error category: 0
  Event: 10005 Source: DCOM
  DCOM got error "% 1058" try to start the service NMIndexingService with arguments "" to start the server: {E8933C4B-2C90-4A04-A677-E958D9509F1A}

  Journal: 'System' time: 23/01/2012 18:28:49
  Type: error category: 0
  Event: 7023 Source: Service Control Manager
  Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: a device attached to the system is not functioning.

  Journal: "System" Date/time: 24/01/2012 23:35:59

  Parameters of scanning has been:

  • System
  • Errors
  • 1-20 errors, valued at twenty.

  What are these errors and they are nothing to worry about?

  I have Nero 8 on this system and have an updated hosts file the running here: http://winhelp2002.mvps.org/hosts.htm

  Not sure, but I may have changed a network setting to activate the new hosts file work properly.

  Seen these errors for a while. system works well and smoothly.  No symptoms of malware or infection seen or found.  I would call these software errors as they seem does not affect the operation of the system.

  XP Home Edition SP3 P4 2.8 2 GB RAM

  Joe

  Oh yes :)

  I have never used the program VEW and don't think I will check it - I just look at the Event Viewer logs the old-fashioned way (manually) if I think that there is a problem, but that might just be the old me.

  It is true that XP Home doesn't have Group Policy Editor, but all policy settings are always available via the registry.

  Some malware will change your GP settings and cause problems.

  I have a little import registry will correct all the ones I know, so if someone has these symptoms, any flavor of XP, they are running, I'll just send the script because sometimes you will be not able to solve the problem, even if you have not the GP Editor.

  The registry always import work - and work well for XP Home or XP Pro.  If you have the symptoms and XP Home, what would you?   Start the import operation of the registry.

  If you're curious, off on my SkyDrive it is a spreadsheet Excel (Group Policy settings) who has all the parameters of GP and where they are in the registry.  I do not recommend start searching, but it is useful to know where things are if there is a problem.

  I would not allow the connection of a security XP stuff unless you think you're being attacked.  More and verbose logging slows things down.  My Event Viewer Security log is empty.

  Find the links to the Microsoft Support Engineer for the most part useless to actually solve a problem (because it help you with your problem), if someone has a question or point of Event Viewer, I usually just send them this:

  To view the logs in Event Viewer, click Start, settings, Control Panel, administrative tools, event viewer.

  A shortcut to the event viewer is to click on start, run and enter in the box:

  %SystemRoot%\system32\eventvwr.msc

  Click OK to launch the event viewer.

  The most interesting newspapers are usually the system and Application logs.

  Some newspapers such as security and Internet Explorer may be completely empty or have just a few items.  The default settings for XP wants do not connect all this activity, unless you need to solve a problem in these areas.  If you enable logging for them the papers fill up quickly and could adversely affect the performance of your system with all the extras (often unnecessary) activity.

  If you have Microsoft Office installed, it has its own newspapers, and they can be empty or occasional boring activity very little or, if there is no problem with your desktop applications.  It's normal.

  Not every event is a problem, some are informational messages that things work very well, and some are warnings.

  However, no event should defy reasonable explanation.

  Each event is sorted by Date and time.  Errors will be red Xs, warnings will have yellow! s.
  Informational messages have white is.  Not every error or warning event means that there is a serious question.

  Some are excusable at boot time when Windows starts.  Try to find only the events to the date and time around your problem.

  If you double-click on an event, it will open a window of properties with more information.  On the right are black up and down arrow keys to scroll through the open events. The third button that looks like two overlapping pages is used to copy the details of the event in your Windows Clipboard.

  When you find an interesting event that occurred at the time of your question, click on the third button at the top and arrows to copy the details and then you can paste the details (right click, paste or CTRL-V) the text in detail here for analysis.  Remove all personal information from your information after you paste If you are forced to do so.

  If you paste an event, it will look something like this annoying system startup event:

  Event type: Information
  Event source: Service Control Manager
  Event category: no
  Event ID: 7035
  Date: 14/07/2010
  Time: 17:54:18
  User: Jose
  Computer: computer

  Description:
  The Remote Access Connection Manager service was sent successfully a starting control.

  To get a fresh start on any log of the event viewer, you can choose to clear the log (the log backup is available), and then reproduce your problem, then just look at the events around your show and troubleshoot events that are happening when you have your question.

  You can search for events on the World Wide Web and get ideas.  It's where people events they see and then to the top of their questions, ideas and solutions:

  http://www.EventID.NET/

  If you find your event in the discussion, the first idea or discussion does not necessarily mean it is the "answer" to your situation, so read through all the ideas to find the one that sounds more like your situation.

• Windows restarts by itself. Event Viewer says pushed user control.alt, delete or start button when I did not.

  Auto restart is disabled.

  Please post that those event (s) so we can see what they look like and provide more information about your system/question:

  Here is a method to display specific information about individual events.

  To view the logs in Event Viewer, click Start, settings, Control Panel, administrative tools, event viewer.

  A shortcut to the event viewer is to click on start, run and enter in the box:

  %SystemRoot%\system32\eventvwr.msc /s

  Click OK to launch the event viewer.

  The most interesting newspapers are usually the Application and the system.

  Some newspapers such as security and Internet Explorer may be completely empty or have just a few items.  The default settings for XP wants do not connect all this activity, unless you need to solve a problem in these areas.  If you enable logging for them the papers fill up quickly and could adversely affect the performance of your system with all the extras (often unnecessary) activity.

  If you have Microsoft Office installed, it has its own newspapers, and they can be empty or occasional boring activity very little or, if there is no problem with your desktop applications.  It's normal.

  Not every event is a problem, some are informational messages that things work very well, and some are warnings.

  However, no event should defy reasonable explanation.

  Each event is sorted by Date and time.  Errors will be red Xs, warnings will have yellow! s. information messages have white are.  Not every error or warning event means that there is a serious question.   Some are excusable at boot time when Windows starts.  Try to find only the events to date
  and the time around your problem.

  If you double-click on an event, it will open a window of properties with more information.  On the right are black up and down arrow keys to scroll through the open events. The third button that looks like two overlapping pages is used to copy the details of the event in your Windows Clipboard.

  When you find an interesting event that occurred at the time of your question, click on the third button at the top and arrows to copy the details and then you can paste the details (right click, paste or CTRL-V) the text in detail here for analysis.  Remove personal information from your information
  After having stuck if you are forced to do so.

  If you paste an event, it will look something like this annoying system startup event:

  Event type: Information
  Event source: Service Control Manager
  Event category: no
  Event ID: 7035
  Date: 14/07/2010
  Time: 17:54:18
  User: Jose
  Computer: computer

  Description:
  The Remote Access Connection Manager service was sent successfully a starting control.

  Maybe someday the dialog box 'ask a question' forums XP will ask these questions automatically when a new thread is started so I don't have to ask every time.  It might even be possible to solve a problem in a single response when enough information is provided.

  Please provide additional information on your system:

  What is your system brand and model?

  What is your Version of XP and the Service Pack?

  Describe your current antivirus and software anti malware situation: McAfee, Symantec, Norton, Spybot, AVG, Avira!, MSE, Panda, Trend Micro, CA, Defender, ZoneAlarm, PC Tools, Comodo, etc..

  The afflicted system has a CD/DVD drive work?

  You have a true bootable XP installation CD (it is not the same as any recovery CD provided with your system)?

  What you see you don't think you need to see?

  What do not you think that you should see?

  Fill in the blank: my system was working fine until this happened: _.

  If the system used to work properly, what do you think might have changed since the last time, it didn't worked properly?

  Do, or do not. There is no test.

  I decided to implement the points for a new puppy instead of a pony!

• Error in Event Viewer and warning messages.

  original title: ERROR EVENT VIEWER AND warning MESSAGES

  My computer is running Windows XP Media Center Edition and if I click on the PANEL, performance and Maintenance, administrative tools, event viewer and select Application and/or system I see RED around the icons who say ERROR and yellow triangular icons who say WARNNING. This condition is a problem and what is the origin of the messages must be generated?

  Hi SamRyan,

  See this article which should give you more details on the event viewer.

  Procedure to view and manage event logs in Event Viewer in Windows XP

  See also:

  Microsoft Windows XP - using Event Viewer

• Download ID5032 failure auditing on the event viewer.

  Original title: anonymous logon in the event viewer

  3 (network) domain of anonymous logon appears in my security on Vista event viewer, Audit failure ID5032 follow-up.  Is this normal or is this malware?  There are two implications of Internet Explorer running in the Task Manager, but two relatives when I close the browser, IE9: is this normal please?  I also get Audit failure ID5038, any advice as to the causes, remedies and the dangers of these events would be much appreciated, thank you.

  Hi robin,

  The two instances of IE9 running in the Task Manager is normal.

  See the link below

  http://answers.Microsoft.com/en-us/IE/Forum/IE8-windows_other/Windows-Task-Manager-showing-iexploreexe-running/94fd4ed8-652C-4756-B733-8b87c967e7ac

  Reference before:

  You can also run this next fixit.

  Difficulty Internet Explorer issues to make it fast, secure and stable IE http://support.Microsoft.com/mats/ie_performance_and_safety/en-us

  Hope this information helps.

• How to use Event Viewer to erase the mistakes/Vista

  How to use the event viewer.in performance information a tools / tools... built a lot of mistakes over time... Vista Home Basic to system op.  also it would help to speed up my computer?... can someone help me please...

  Hello

  To add to the good advice of dax1792:

  MyEventViewer can be verified at the time of the EVENT or the blue screen (BSOD) within a second
  then the EVENT or time of the BSOD for more information on the possible cause - see TIP.

  MyEventViewer - free - a simple alternative in the standard Windows Event Viewer.
  TIP - Options - Advanced filter allows you to see a period of time instead of the whole of the record-
  Set it a bit before and after the time of the EVENT or the BSOD.
  http://www.NirSoft.NET/utils/my_event_viewer.html

  This ulilty also lets you clean (remove) one, several or all the logs in Event Viewer. Only
  real reason to remove them would be to make it easier to read all the new events - those recording after
  compensation.

  ------------------------------

  TechNet - observer of events
  http://TechNet.Microsoft.com/en-us/library/cc766042.aspx

  TechNet - clear an event log
  http://TechNet.Microsoft.com/en-us/library/cc722318.aspx

  I hope this helps.
  --------------------------------------------------------------------------------------------
  Rob Brown - Microsoft MVP<- profile="" -="" windows="" and="" devices="" for="" it :="" bicycle="" -="" mark="" twain="" said="" it="">

• When I opened e-mails. doc or pdf, this message appears: "the application failed to start because its side-by-side configuration is incorect. Check the log of events applications for more details. »

  Original title: side-by-side configuration is incorrect

  When I opened, try opening some emails. doc or pdf, this msg appears: "the application failed to start because its side-by-side configuration is incorect. Check the log of events applications for more details. »

  I'm going to log events, but how to solve the problem by putting the RIGHT configuration to?

  Thanks in advance

  Hello

  1. when the question is is produced?

  2. you remember of any change to your computer before the problem?

  3. are you using a 32-bit operating system or a 64-bit?

  Please visit: What are the information in the event logs? (Event Viewer)

  In the meantime, follow these steps and check if they help.

  Step 1:

  I suggest you install the Visual C ++ 2005 Sp1 Runtime and check if the problem persists:

  Microsoft Visual C++ 2005 SP1 Redistributable Package (x 86)

  http://www.Microsoft.com/downloads/en/details.aspx?FamilyId=200b2fd9-AE1A-4a14-984d-389c36f85647&displaylang=en

  Step 2:

  If this does not resolve the issue, I would have you done SFC scan on your machine to check if the problem is related to missing or corrupted system files.
   
  Aziz Nadeem - Microsoft Support
  [If this post was helpful, please click the button "Vote as helpful" (green triangle). If it can help solve your problem, click on the button 'Propose as answer' or 'mark as answer '. [By proposing / marking a post as answer or useful you help others find the answer more quickly.]

• Link to 'help journal online events' event viewer returns a page not found on the technet Web site

  Whenever I click on the link "online help for event log" of event viewer for further help on an error, it returns the page not found on TechNet. Why? If Microsoft has moved the page, or something, why has he not updated the links in this application? I use Windows 8 (upgrade of Windows 7) and all applied Windows updates.

  Well, I spoke with Microsoft Support Thursday and it seems that the Event Viewer online Help is not available yet in Windows 8.

  While I took for them they connected to my system then tried their own with the same results, they then got on the? (could be the resource group... can't remember) who told supporters that on line assistance has not been fully developed for Windows 8 and therefore has not been published!

• Add the windows firewall with the security log for windows 2008 Event Viewer

  Hi all

  I would like to see weather which is turn on the Windows or turn OFF firewall and at what time on Windows 2008.

  As what I had checked, I could see this on Windows 7 (Event Viewer/Applications and Services/Logs/Microsoft/Windows/Windows Firewall With Advanced Security/Firewall), but this does not show on Windows 2008.

  Is anyway to add this in Windows 2008?

  Your help is very appreciated.

  BR/WT.

  Hi all

  I would like to see weather which is turn on the Windows or turn OFF firewall and at what time on Windows 2008.

  As what I had checked, I could see this on Windows 7 (Event Viewer/Applications and Services/Logs/Microsoft/Windows/Windows Firewall With Advanced Security/Firewall), but this does not show on Windows 2008.

  Is anyway to add this in Windows 2008?

  Your help is very appreciated.

  BR/WT.

  Best place to get the most appropriate response is technet...

  Please repost this under, http://social.technet.microsoft.com/Forums/windowsserver/en-US/home

• I get the error message "security log is full, only an administrator can log in to solve the problem."

  On a windows machine XP after putting in place the machine administrator and when trying to connect as a user, I get the error message "security log is full, only an administrator can log in to solve the problem." I know how to solve this problem by going to the event viewer, by selecting the security log and by setting the journal to "ignore the events as needed", but I would like to create a script that will do this automatically for me.

  so far my research revealed that the value of the registry key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security] "MaxSize" controls this setting and changing the value default DWORD_VALUE to 0 x 01000000 to 0 x 00000000, change is possible. Well, when I did it in regedit, nothing has changed in the security log properties, the default setting of 'remove older items after 7 days' remained the same.

  Can someone tell me what registry key, I need to change in order to make this change? Keep in mind im trying to include this in a script.

  Thank you

  Hi teddorosheff,

  Your question is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please ask your question in the following forum.

  Windows Vista IT Pro