Search Results

Search found 16890 results on 676 pages for '2008 archive'.

Page 51/676 | < Previous Page | 47 48 49 50 51 52 53 54 55 56 57 58  | Next Page >

• Windows Server 2008 Task Scheduler Tasks Not Executing

  - by omatase

  I've been having an intermittent problem for some time now with the Windows Task Scheduler that I can't work out. I use the task scheduler to run a C# app I've written that has various plugins used to ensure production systems are working. This task scheduler itself is actually a production system so I have one simple task that executes every 8 minutes to notify an external monitoring system that the task scheduler is still up. If this external service fails to receive an "all-clear" at least once every 15 minutes (or so I don't remember the exact number right now) it will message us that the monitoring system is down. In the past we've had intermittent "down" messages from time to time and each time I've investigated the cause I was unable to find any problems. So this time I wanted to ask the StackOverflow community since it doesn't look like I'll have luck on my own. This morning at 2:32 AM the task fired (exactly 8 minutes after the previous firing) however the task didn't fire again until 3:28. There are no errors that I can see in the Event Viewer at this time. When I look at the Task Scheduler log there are no errors there either. Here is what the log looks like though: Information 6/11/2011 3:28:56 AM 102 Task completed (2) d6cf2412-269e-48bf-9f40-4a863347baad Information 6/11/2011 3:28:56 AM 201 Action completed (2) d6cf2412-269e-48bf-9f40-4a863347baad Information 6/11/2011 3:28:55 AM 129 Created Task Process Info Information 6/11/2011 3:28:55 AM 200 Action started (1) d6cf2412-269e-48bf-9f40-4a863347baad Information 6/11/2011 3:28:55 AM 100 Task Started (1) d6cf2412-269e-48bf-9f40-4a863347baad Information 6/11/2011 3:28:55 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:55 AM 107 Task triggered on scheduler Info d6cf2412-269e-48bf-9f40-4a863347baad Information 6/11/2011 3:28:15 AM 102 Task completed (2) b91fe5ce-39ef-42fb-adbe-bd8be012c00a Information 6/11/2011 3:28:15 AM 201 Action completed (2) b91fe5ce-39ef-42fb-adbe-bd8be012c00a Information 6/11/2011 3:28:15 AM 102 Task completed (2) 556c07dc-2724-4a21-a97e-dc4abd56f94d Information 6/11/2011 3:28:15 AM 201 Action completed (2) 556c07dc-2724-4a21-a97e-dc4abd56f94d Information 6/11/2011 3:28:15 AM 102 Task completed (2) 79328289-f742-49dd-aa0d-c3d05db50895 Information 6/11/2011 3:28:15 AM 201 Action completed (2) 79328289-f742-49dd-aa0d-c3d05db50895 Information 6/11/2011 3:28:15 AM 102 Task completed (2) 19743755-47b6-4b98-9bec-052193be9496 Information 6/11/2011 3:28:15 AM 201 Action completed (2) 19743755-47b6-4b98-9bec-052193be9496 Information 6/11/2011 3:28:15 AM 102 Task completed (2) c165754f-e3e6-4176-a327-11f9c06c39a5 Information 6/11/2011 3:28:15 AM 201 Action completed (2) c165754f-e3e6-4176-a327-11f9c06c39a5 Information 6/11/2011 3:28:15 AM 102 Task completed (2) 0e62ad3e-1f6e-40c0-9155-19f0108dee22 Information 6/11/2011 3:28:15 AM 201 Action completed (2) 0e62ad3e-1f6e-40c0-9155-19f0108dee22 Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) 0e62ad3e-1f6e-40c0-9155-19f0108dee22 Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) c165754f-e3e6-4176-a327-11f9c06c39a5 Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) 19743755-47b6-4b98-9bec-052193be9496 Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) 79328289-f742-49dd-aa0d-c3d05db50895 Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) 556c07dc-2724-4a21-a97e-dc4abd56f94d Information 6/11/2011 3:28:10 AM 129 Created Task Process Info Information 6/11/2011 3:28:10 AM 200 Action started (1) b91fe5ce-39ef-42fb-adbe-bd8be012c00a Information 6/11/2011 3:28:10 AM 100 Task Started (1) 0e62ad3e-1f6e-40c0-9155-19f0108dee22 Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 100 Task Started (1) c165754f-e3e6-4176-a327-11f9c06c39a5 Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 100 Task Started (1) 19743755-47b6-4b98-9bec-052193be9496 Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 100 Task Started (1) 79328289-f742-49dd-aa0d-c3d05db50895 Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 100 Task Started (1) 556c07dc-2724-4a21-a97e-dc4abd56f94d Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 100 Task Started (1) b91fe5ce-39ef-42fb-adbe-bd8be012c00a Information 6/11/2011 3:28:10 AM 319 Task Engine received message to start task (1) Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info 0e62ad3e-1f6e-40c0-9155-19f0108dee22 Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info c165754f-e3e6-4176-a327-11f9c06c39a5 Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info 19743755-47b6-4b98-9bec-052193be9496 Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info 79328289-f742-49dd-aa0d-c3d05db50895 Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info 556c07dc-2724-4a21-a97e-dc4abd56f94d Information 6/11/2011 3:28:10 AM 107 Task triggered on scheduler Info b91fe5ce-39ef-42fb-adbe-bd8be012c00a Information 6/11/2011 2:32:56 AM 102 Task completed (2) 16e4f2c3-a340-410a-9c14-4bfe0861fdd5 Information 6/11/2011 2:32:56 AM 201 Action completed (2) 16e4f2c3-a340-410a-9c14-4bfe0861fdd5 Information 6/11/2011 2:32:55 AM 129 Created Task Process Info Information 6/11/2011 2:32:55 AM 200 Action started (1) 16e4f2c3-a340-410a-9c14-4bfe0861fdd5 Information 6/11/2011 2:32:55 AM 100 Task Started (1) 16e4f2c3-a340-410a-9c14-4bfe0861fdd5 Information 6/11/2011 2:32:55 AM 319 Task Engine received message to start task (1) Information 6/11/2011 2:32:55 AM 107 Task triggered on scheduler Info 16e4f2c3-a340-410a-9c14-4bfe0861fdd5 Seems kind of strange. I also have two other C# apps that run and check something each hour on the hour using task scheduler. If I look at the history for those I can see that they didn't execute at 3 AM either! They all waited until 3:28 to start as well. If I look at "tasks completed" in the Event Viewer it shows that only one task was able to run between the 2:32 AM to 3:28 AM time period. The task was "\Microsoft\Windows\RAC\RACAgent" And here's what it looked like: Information 6/11/2011 3:18:09 AM 102 Task completed (2) 00c53a85-ba20-4666-80db-fbbe2492c0ad Information 6/11/2011 3:18:09 AM 201 Action completed (2) 00c53a85-ba20-4666-80db-fbbe2492c0ad Information 6/11/2011 3:18:08 AM 129 Created Task Process Info Information 6/11/2011 3:18:08 AM 200 Action started (1) 00c53a85-ba20-4666-80db-fbbe2492c0ad Information 6/11/2011 3:18:08 AM 100 Task Started (1) 00c53a85-ba20-4666-80db-fbbe2492c0ad Information 6/11/2011 3:18:08 AM 319 Task Engine received message to start task (1) I appreciate any ideas anyone may have.

  Read the article

• SMB access from XP to Windows 2008 R2

  - by Pablo

  Here's the thing... I have a very slow file copy performance from Windows XP clients to Windows 2008R2 servers. Here are the facts: Windows XP to Windows 2K3: Fast Windows XP to Windows 2K8: Very Slow Windows 7 to Windows (any): Fast Despite the fact that the obvious solution would be to upgrade to Windows 7, well, we have 900 desktops so it's not an option in the short time. I have tried everything: Disabling SMB2.0, disabling security signatures, changing the TCP Window size, disabling the W2K8 auto tuning, upgraded the drivers, etc. We eliminated the network; both the server and the client are connected to the same core switch (no hops, no routers, same VLAN). Upon monitoring the network with a packet capture utility, we see that the SMB packets being exchanged between the W2K8 and the XP machines are very small packets (256 bytes); despite the fact that the MTUs are properly set (1500) and there is no fragmentation whatsoever. In fact, those SMB packets show, on the IP datagram, that the window is 65535 or close. The same trace, made using the same application but instead of using a W2K8 share uses a Windows XP share (and that goes FAST) shows SMB packets of 4096 bytes. I can post the traces if necessary. So, why does XP-W2K8 negotiation arrange for 24-bytes SMB payload, whereas the XP-XP negotiation arranges for 4096 SMB packets? Any ideas? I am running short of those...

  Read the article

• Auditing events 4656 and 4658 on Windows folder on Server 2008

  - by PCurd

  During an overnight system state backup we are seeing thousands of success audit events (4656, 4658) on the folder c:\windows\servicing, system32 and others in the windows folder. We use file success auditing on some files so I can't disable it but this deluge is filling up the logs and making reporting tricky. What is the harm of changing the auditing settings on the windows folder? What are the recommended settings to put on the files for those people doing system state backups? Thanks,

  Read the article

• Windows Server 2008 R2 - IIS7.5 - Web site permissions

  - by dmckenna

  Why when I remove the MACHINENAME\Users group permission set from a websites physical folder and and grant a similar permission set to MACHINENAME\IIS_IUSRS group my website will not start. Why do I have to grant Read & Execute, List folder contents and Read to the MACHINENAME\Users group physical website folder?

  Read the article

• Windows Server 2008 SMTP & POP3 Configuration

  - by Alex Hope O'Connor

  This is the first time I have ever configured a VPS server without 3rd party applications such as Plesk control panel. I have got most functionality working in all my websites except I am very unsure as to how I can setup my email functionality on this new server. Basically I want the standard POP3 functionality, a bunch of accounts with private boxes, all able to send and receive emails using their individual usernames and passwords. My server setup is pretty simple, its a VPS with IIS & DNS Server running. What I have tried to do to setup SMTP & POP3 is adding the SMTP Server feature through the Server Manager Console (very unsure of the configuration as guides I found did not explain), I then installed a 3rd party application called Visdeno SMTP Extender as it claims to be a POP3 service providing accounting and the ability to communicate with email clients. That is as far as I have gotten as I can not seem to find too much information on the subject. So can someone please tell me how to go about configuring these services in order to provide standard SMTP & POP3 functionality? Thanks, Alex.

  Read the article

• Whats the difference between local and remote addresses in 2008 firewall address

  - by Ian

  In the firewall advanced security manager/Inbound rules/rule property/scope tab you have two sections to specify local ip addresses and remote ip addresses. What makes an address qualify as a local or remote address and what difference does it make? This question is pretty obvious with a normal setup, but now that I'm setting up a remote virtualized server I'm not quite sure. What I've got is a physical host with two interfaces. The physical host uses interface 1 with a public IP. The virtualized machine is connected interface 2 with a public ip. I have a virtual subnet between the two - 192.168.123.0 When editing the firewall rule, if I place 192.168.123.0/24 in the local ip address area or remote ip address area what does windows do differently? Does it do anything differently? The reason I ask this is that I'm having problems getting the domain communication working between the two with the firewall active. I have plenty of experience with firewalls so I know what I want to do, but the logic of what is going on here escapes me and these rules are tedious to have to edit one by one. Ian

  Read the article

• Domain Environment + Certificate Authority + Server 2008 R2

  - by user1110302

  I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the best practices are for going about this task, and have decided that in an ideal CA environment you should have one “offline” Root CA, and then two subordinate CAs for redundancy/issuing the certs. That is all good, I understand how this works and why, but in messing with a sandbox I have setup, the way you go about adding certificate authorities to a domain environment seems extremely trivial and against all of their best practices… Dooes anyone know what the purpose is of an Enterprise Root CA that is integrated into Active Directory? From what I have read, once you setup an Enterprise Root CA that is integrated into Active Directory, it stays with Active Directory for the long haul and must not be turned off/renamed/touched under any circumstances. If this is true, that seems to go against the practice of setting up a standalone root CA, adding the subordinates, and then taking the root offline. Thanks for any feedback you may have to offer!

  Read the article

• Biztalk 2009 logshipping with SQL 2008

  - by Manjot

  Hi, I am setting up biztalk logshipping for Biztalk 2009 database. Following http://msdn.microsoft.com/en-us/library/aa560961.aspx article, I am doing the following to setup biztalk logshipping on destination server: Enable Ad-hoc queries by: sp_configure 'show advanced options',1 go reconfigure go sp_configure 'Ad Hoc Distributed Queries',1 go reconfigure go sp_configure 'show advanced options',0 go reconfigure go Execute LogShipping_Destination_Schema & LogShipping_Destination_Logic in master on destinations server Run: exec bts_ConfigureBizTalkLogShipping @nvcDescription = '', @nvcMgmtDatabaseName = '', @nvcMgmtServerName = '', @SourceServerName = null, -- null indicates that this destination server restores all databases @fLinkServers = 1 -- 1 automatically links the server to the management database When I run this I am receiving the following error: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. After some research I found some info : Usually this error means that the SQL Server Service Principal Name (SPN) was not configured, and NTLM was not being used as an authentication mechanism. SQl services are runing under different domain accounts. So, I asked the domain admin to create SPNs for the servers, SQL service accounts for beoth source and destination using name and FQDN. enabled computer name and service accounts for delegation. When I run the following: select * from sys.dm_exec_connections I get the the same error: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' Any help please?

  Read the article

• Group policy software installation feature on server 2008

  - by Force Flow

  What is the proper procedure for distributing software updates using group policy's software installation feature? For example, if I want to install Java, and Java 1.7u6 is already added as a package, should I: A) Remove the Java 1.7u6 package (selecting the "allow users to continue to use" option), and add Java 1.7u7? B) Add Java 1.7u7 and specify that it is an update to the existing 1.7u6 package? (Will this install the oldest version first, then install each update one after the other, or will it just install the latest package?) Note that this question is geared toward the operation of the software installation feature of group policy, not specifically the behavior of the Java installers. This could easily apply to the installation of Adobe Flash, Adobe Reader, or any other common software applications with frequent updates.

  Read the article

• Default document not working after installing SP1 on Windows 2008 R2 x64

  - by boredgeek

  We have a web site that should only be available for authorized users. So we deny anonymous access for the site. However we do allow anonymous access to the default page and the login page. When we installed SP1 the behavior of the server changed. Now if the user is trying to access the root of the site, say http://mysite.com, she is redirected to login page rather than the default page. Is there a hotfix to bring back the previous behavior?

  Read the article

• Windows Server 2008 Block IP aftfer number of faulty logins

  - by Martijn B

  Hi there, I have a lot of faulty login attempts on my windows server. Is it possible to ban an IP number for a certain amount of time after for example 10 faulty login attempts. Is this possible with WFAS? Thanks, Martijn

  Read the article

• Server 2008 R2 How to Change Windows 7 Basic Theme Color

  - by Wes Sayeed

  We're deploying thin clients connecting to a terminal server farm. The computers have high visibility to the public and I would like them to at least look presentable and not like something out of 1995. So I installed the Desktop Experience feature and enabled the Theme service. The server will not support Aero because it has no 3D graphics, but we can enable the Windows 7 Basic theme, which has the Aero look without the 3D effects. The problem with that theme is that you can select any window color you want, as long as it's baby boy blue. Is there a way to make those windows another color? The window color controls do nothing.

  Read the article

• MMC crashes on Windows Server 2008 x64 - Exchange console, event viewer

  - by David M Williams

  Help! I don't know what happened; this server has been very reliable but suddenly began having problems with a particular .NET 2.0 web site simply hanging - it wouldn't load at all. However, another ASP.NET site was still fine. Reinstalling the site didn't fix it, nor did deleting and re-creating the application within IIS. Trying the event viewer was met with a horrifying "Microsoft Management Console has stopped working". Some Googling led me to believe the .NET framework was the problem. I found a tool called the .NET cleanup tool - http://blogs.msdn.com/astebner/pages/8904493.aspx - which cleaned out .NET entirely. I reinstalled .NET 1.1 and 3.5 (which installed 2.0 and 3.0 as well). Using the .NET verification tool - http://blogs.msdn.com/astebner/pages/8999004.aspx - I believe these have all installed ok. However, my server is in worse shape now. The Exchange 2010 Management Console crashes with an MMC error and now my other (previously reliable) .NET web app now hangs on loading too. I thought I should use Computer Management to remove and re-add the application and web server roles but sure enough, MMC crashes. If anyone can help I will be extremely grateful. Thank you !

  Read the article

• How to enable extended logging for classic asp on IIS7 on Windows 2008 R2

  - by Neil Trodden

  I had to deploy an application that was not written by me onto the above configuration. It is a rather bizarre hybrid of asp.net and classic asp and it's the classic asp that is proving troublesome. The client is having problems with 500 Internal Server Errors appearing and I can see some of these in the logs but I only get the error code and the page name but little else. What I would like to see is the actual error message to at least give me an idea what is going on (or not going on, depending on your point of view) I don't want to display errors in the browser as I don't know the code well enough and this could (for all I know) display some crazy code where the db password is hard-coded into the site.

  Read the article

• Expired Windows Server 2008 trial remote activation

  - by Garry Harthill

  I have a remote server which has an expired license. I can't currently add the new license because of a licensing server error so I need to reboot the machine. My question is will I be able to remote desktop onto the machine and apply the new license or do I have to be physically at the server. I know an activation wizard usually appears and doesn't let you go any further but does this same wizard appear over remote desktop? I don't really want to reboot the machine only for it to not come up again.

  Read the article

• Can't uninstall SBS 2003 in sbs 2003 -> sbs 2008 migration

  - by ChrisMuench

  I'm trying to remove sbs from my sbs 2003 server. Also I'm logged in as Administrator. However When I start to go through the wizard it gives me the following error. You must be a member of the Domain Admins, Schema Admins, and Enterprise Admins group. I then did some research and found this (http://support.microsoft.com/kb/842694) and I came to the point where it says to delete the server from Sites and Services. However when I clicked delete it wanted me to dcpromo the box first. However I have read you have to uninstall exchange first and then dcpromo it to remove AD. Any ideas?

  Read the article

• FIle Services Resource Manager alternative for Windows Web Server 2008

  - by Alexey Zakharov

  Hi guys, We need to provide disk quota managment for specific folders. On our hosting server Windows Web Server edition is installed. It has not File Server role that is why I cannot use FIle Services Resource Manager. Is there any alternative product (it would be great if it is opensource or freeware) which can perform the same task? Best regards, Alexey Zakharov

  Read the article

• Setting up a Pagefile and Partition in Server 2008

  - by Brett Powell

  I am setting up 18 new machines for our company, and I have instructions from my new boss on setting up a Pagefile and Partition. I have looked at their existing machines to base the new setups off of, but there is no consistency between any 2 machines, which has left me extremely frustrated to say the least. My instructions are... 1) Set a static pagefile (use recommended value as max/min), set it on SSD if SSD available. 2) Make 3 partitions: C: is used for OS and install files D: is used for backups on machines with a SSD. On machines without SSD create a D: partition for pagefile (2*installed RAM for partition size) E: must be the partition hosting user files I have never messed with Pagefiles before, and looking at their existing machines is offering no help. My questions are... 1) As the machines I am setting up have no SSD (just 2 SATA drives) does it sound like the Pagefile should be setup on the C: (primary) drive or the D:? The instructions are vague so I have no idea. 2) As C: and D: are both Physical drives, does it sound like C: should be partitioned out to create the E: drive or D:? Thanks for any help I can get. I am extremely stressed out under a massive workload right now, and these vague instructions are quite infuriating.

  Read the article

• Access Denied / Server 2008 / Home Directories

  - by Shaun Murphy

  Domain Controller: BDC01 (192.168.9.2) Storage Server: BrightonSAN1 (192.168.9.3) Domain: brighton.local Last night I moved our users home directories off of our Domain Controller onto a storage server using the MS FSMT. I'm getting a mixed bag of errors. The first being some users cannot logon properly, they can't access the logon.vbs in the sysvol folder on the DC and consequently cannot map their drives. I've narrowed that down to a DNS issue as we there was a remnant of our previous DNS server in the DHCP server options and scope options. I'm able to get their drives remapped by browsing to the sysvol folder by IP address as opposed to Computer Name and manually running the logon.vbs script. The other error I'm getting is Access Denied on a few of the users home directories. The top level folder (Home) is shared as normal and I've removed and re-added the NTFS security a number of times now including making the user the owner with full control. I've checked each and every individual file and folder in said users home directory and they are indeed the owner but I'm unable to write but I can read the contents. I'm stumped. This isn't happening to all clients. I'm considering removing their AD accounts, backing up their folders and readding them as a last resort but obviously I'd like to know why the above errors are happening.

  Read the article

• Excluding specific file types from a security audit in windows server 2008

  - by Mozez

  Hi, I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such as a temp Word file that is automatically deleted when the app is closed) which I do not care about. Would anyone know of a way to exclude these types of files from being logged? Thanks in advance for any comments.

  Read the article

• SQL Server 2008 - scheduled copy of production database into test and development databases

  - by Anders Juul

  Hi all, I wish to schedule a copy from my production database into two other databases. The databases are located on same server (instance?). The databases are currently backed up to server hard drive every night and basing a solution on this backup would be fully satisfactory. What is the best way to do this? Any comments appreciated, Anders, Denmark

  Read the article

• Subdomains for different applications on Windows Server 2008 R2 with Apache and IIS 7 installed

  - by Yusuf

  I have a home server, on which I have installed Apache, and several other applications that have a Web GUI (JDownloader, Free Download Manager). In order to access each of these apps (whether be it from the local network or the Internet), I have to enter a different port, e.g., http://server:8085 or http://xxxx.dyndns.org:8085 for Apache http://server:90 or http://xxxx.dyndns.org:90 for FDM http://server:8081 or http://xxxx.dyndns.org:8081 for JDownloader I would like to be able to access them using sub-domains, e.g, http://apache.server or http://apache.xxxx.dyndns.org for Apache, http://fdm.server or http://fdm.xxxx.dyndns.org for FDM, http://jdownloader.server or http://jdownloader.xxxx.dyndns.org for JDownloader First of all, would it be possible like I want it, i.e., both from LAN and Internet, and if yes, how? Even if it's possible only for Internet, I would like to know how to do it, if there's a way.

  Read the article

• Windows SBS 2008 domain, Outlook 2010 calendar sharing / appointments not synced

  - by indeed005

  A user on this network reports not being able to delete appointments on Outlook 2010 calendars that are shared (not delegated) with other users in the domain. Specifically, the delete appears to work, but after 5 seconds or so the appointment re-appears. Permissions seem fine. Problem does not occur with other users because they do not share calendars. Is this behaviour intended (appointments re-appearing after they have been deleted)?

  Read the article

• Remote Desktop failed logon event 4625 not logging correctly on 2008 Terminal Services server

  - by Zone12

  When I use the new remote desktop with ssl and try to log on with bad credentials it logs a 4625 event as expected. The problem is, it doesn't log the ip address, so I can't block malicious logons in our firewall. The event looks like this: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{00000000-0000-0000-0000-000000000000}" /> <EventID>4625</EventID> <Version>0</Version> <Level>0</Level> <Task>12544</Task> <Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords> <TimeCreated SystemTime="2012-04-13T06:52:36.499113600Z" /> <EventRecordID>467553</EventRecordID> <Correlation /> <Execution ProcessID="544" ThreadID="596" /> <Channel>Security</Channel> <Computer>ontheinternet</Computer> <Security /> </System> <EventData> <Data Name="SubjectUserSid">S-1-0-0</Data> <Data Name="SubjectUserName">-</Data> <Data Name="SubjectDomainName">-</Data> <Data Name="SubjectLogonId">0x0</Data> <Data Name="TargetUserSid">S-1-0-0</Data> <Data Name="TargetUserName">notauser</Data> <Data Name="TargetDomainName">MYSERVER-PC</Data> <Data Name="Status">0xc000006d</Data> <Data Name="FailureReason">%%2313</Data> <Data Name="SubStatus">0xc0000064</Data> <Data Name="LogonType">3</Data> <Data Name="LogonProcessName">NtLmSsp</Data> <Data Name="AuthenticationPackageName">NTLM</Data> <Data Name="WorkstationName">MYSERVER-PC</Data> <Data Name="TransmittedServices">-</Data> <Data Name="LmPackageName">-</Data> <Data Name="KeyLength">0</Data> <Data Name="ProcessId">0x0</Data> <Data Name="ProcessName">-</Data> <Data Name="IpAddress">-</Data> <Data Name="IpPort">-</Data> </EventData> </Event> It seems because the logon type is 3 and not 10 like the old rdp sessions, the ip address and other information is not stored. The machine I am trying to connect from is on the internet and not on the same network as the server. Does anyone know where this information is stored (and what other events are generated with a failed logon)? Any help will be much appreciated.

  Read the article

• I have a Windows Server 2008 R2 box with IIS 7.5

  - by bao

  In Event viewer i have found this: The World Wide Web Publishing Service service entered the stopped state. - - 7036 0 4 0 0 0x8080000000000000 6913 System w2k8x64 - World Wide Web Publishing Service stopped 570033005300560043002F0031000000 How to determine, was server stopped by clicking "Stop" in IIS manager or it stopped itself because of some other reasons? When the stop event occured I was logged in via RDP but I don't remember and clicks in IIS Manager...:( there are no error messages in event viewer

  Read the article

< Previous Page | 47 48 49 50 51 52 53 54 55 56 57 58  | Next Page >