Windows Active Session logon state security event viewer

Hi Team,
i have question.
i already enable audit logging policy from GPO, especially logon logoff audit.
at server event viewer show (security/audit success) display log off and log on event id. 4634 for logoff and 4624 for logon
my question are :
1. Why event viewer always show computer name at account name information? event viewer 4624 logon
can i get the user name info from this event id 4624 logon
2. At event id 4634 logoff, security id and account name info always show computer name account
can i get user name too?
3.  what if the active user log on user never log off ( I mean user only disconnect from RDP session ).
can i get info from security event viewer whose user that being active remote to server?
Thanks
Regards :)

There should be both a computer and a user authentication since both so log onto the domain.
Even though a user may never log off of a machine they still need to establisj a session with other machines for services.  After the intial logon the Kerberos TGT session ticket may be good for the next week (7 days by default) the logs should
still show all newly established sessions.  You may need to review all DC's within the site of the user not just one DC, since any DC within the site could be providing the service.
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

Similar Messages

  • UCCX Agent Desktop v.7 taking over Windows active session when phone rings

    I'm trying to figure out how (if possible) for the Cisco UCCX Agent Desktop application from taking over a users Windows session every time the phone rings.  This is very annoying and takes the end user out of what ever application they are currently in whenever their phone rings.  Does anyone know how to change this?

    Hi Eric,
    Maybe this is better
    Miscellaneous tab options.
    Option Description
    Window Behavior Specify how you want the Agent Desktop window to
    behave:
    • Normal. The window appears when calls are
    present and minimizes when idle.
    • Keep Open. The window is always visible, but may
    be hidden by other open applications.
    • Always on Top. The window is always visible and on
    top of other open applications.
    • Stealth. The window appears as an icon in the
    system tray.
    http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/cad_enterprise/cadenterprise7_0/user/guide/cda700ug.pdf
    Cheers!
    Rob

  • What caused the Windows 2008R2 Security event discarded

    Dear Support team,
    I have a windows 2008 R2 server, The security events didn't recorded from last year.
    1. The maximum log size set to 100 MB, But the log file is 300 MB.  The retention was set to "archive the log when full,do not overwrite events".
    2.  Below last entry security log show the registry key that i modified at that time. After i modify the registry value all of the security event were discarded
    A registry value was modified.
    Subject:
                    Security ID:                              domain\userid
                    Account Name:                        userid
                    Account Domain:                     domain
                    Logon ID:                                0x2c202074
    Object:
                    Object Name:                           \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Security
                    Object Value Name: Retention
                    Handle ID:                               0x100
                    Operation Type:                       Existing registry value modified
    Process Information:
                    Process ID:                               0x129c
                    Process Name:                          C:\Windows\regedit.exe
    Change Information:
                    Old Value Type:                       REG_DWORD
                    Old Value:                                0
                    New Value Type:                      REG_DWORD
                    New Value:                              4294967295
    3. As i know,The Windows Event Log supersedes the Event Logging API beginning with the Windows Vista operating system. Here is the KB link:  http://msdn.microsoft.com/en-us/library/windows/desktop/aa385780(v=vs.85).aspx?ppud=4
    And the registry key which i modified at the before ( \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Security\retention )  Seems only apply to Event logging  for Windows 2003 and prior system. 
    Here is the KB link:  http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx
    May i know what is the reason cause security event discarded ?
    Does the retention setting at Registry still working at windows 2008?
    Thanks very mush.
    Randy

    The new methods are via GPO described here.
    http://technet.microsoft.com/en-us/library/cc722385(v=WS.10).aspx
    http://blogs.technet.com/b/askds/archive/2008/08/12/event-logging-policy-settings-in-windows-server-2008-and-vista.aspx
    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

  • Cannot generate Account Logon Events (Event ID 4624) in Security Event Log on Server 2008 R2 Domain Controller

    I have configured the Default Domain Controller's policy to log SUCCESS for Account Logon Events in the Server 2008 R2 Domain Controller, but these events are not logging in the Security Event log.
    Default Domain Controllers Policy
    Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policies/Audit Account Logon Events = Success.
    What tools can I use to troubleshoot this further? The results of "Auditpol.exe /get /category:*" are below.
    System audit policy
    Category/Subcategory                      Setting
    System
      Security System Extension               No Auditing
      System Integrity                        No Auditing
      IPsec Driver                            No Auditing
      Other System Events                     No Auditing
      Security State Change                   No Auditing
    Logon/Logoff
      Logon                                   No Auditing
      Logoff                                  No Auditing
      Account Lockout                         No Auditing
      IPsec Main Mode                         No Auditing
      IPsec Quick Mode                        No Auditing
      IPsec Extended Mode                     No Auditing
      Special Logon                           No Auditing
      Other Logon/Logoff Events               No Auditing
      Network Policy Server                   No Auditing
    Object Access
      File System                             No Auditing
      Registry                                No Auditing
      Kernel Object                           No Auditing
      SAM                                     No Auditing
      Certification Services                  No Auditing
      Application Generated                   No Auditing
      Handle Manipulation                     No Auditing
      File Share                              No Auditing
      Filtering Platform Packet Drop          No Auditing
      Filtering Platform Connection           No Auditing
      Other Object Access Events              No Auditing
      Detailed File Share                     No Auditing
    Privilege Use
      Sensitive Privilege Use                 No Auditing
      Non Sensitive Privilege Use             No Auditing
      Other Privilege Use Events              No Auditing
    Detailed Tracking
      Process Termination                     No Auditing
      DPAPI Activity                          No Auditing
      RPC Events                              No Auditing
      Process Creation                        No Auditing
    Policy Change
      Audit Policy Change                     No Auditing
      Authentication Policy Change            No Auditing
      Authorization Policy Change             No Auditing
      MPSSVC Rule-Level Policy Change         No Auditing
      Filtering Platform Policy Change        No Auditing
      Other Policy Change Events              No Auditing
    Account Management
      User Account Management                 No Auditing
      Computer Account Management             No Auditing
      Security Group Management               No Auditing
      Distribution Group Management           No Auditing
      Application Group Management            No Auditing
      Other Account Management Events         No Auditing
    DS Access
      Directory Service Changes               No Auditing
      Directory Service Replication           No Auditing
      Detailed Directory Service Replication  No Auditing
      Directory Service Access                No Auditing
    Account Logon
      Kerberos Service Ticket Operations      No Auditing
      Other Account Logon Events              No Auditing
      Kerberos Authentication Service         No Auditing
      Credential Validation                   Success

    Hi Lawrence,
    After configuring the GPO, did we run command gpupdate/force to update the policy immediately on domain controller? Besides, please run command gpresult/h c:\gpreport.html to check if the audit policy
    setting was applied successfully.
    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
    Best regards,
    Frank Shen

  • Error in Event viewer - COM Server application security Issue

    Dear All,
    I am installing one software on windows cluster environment. But while installing I am getting continuous error in System in Event Viewer as 'The application-specific permission settings do not grant Local Activation permission for the COM Server application
    with CLSID {xxxxxxxxxxxxx} and APPID {xxxxxxxxxxxxx} to the user NT SERVICE\SQL Server Distributed Replay Client SID (S-1-5-80-3249811479-4343554-65656-65665) from address LocalHost (Using LRPC). The security permission can be modified using the Component
    Services administrative tool.'
    I have seen in component services, that app ID I am getting for DReplayController service. On security tab if I want to give permission to that particular user then to which user I want to add in 'Launch and Activate permissions'. I am not getting 'SQL Server
    Distributed Replay Controller' user in list.
    So, please help me.
    Thanks in advance.

    Hi,
    Please try to add this account: NT AUTHORITY\SYSTEM.
    More information for you:
    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 2012
    https://social.technet.microsoft.com/forums/systemcenter/en-US/cd8a2c95-70db-4df6-b7f5-eedcc5d898c7/the-applicationspecific-permission-settings-do-not-grant-local-activation-permission-for-the-com
    Event ID 10016 issue in SQL Cluster Server
    https://social.technet.microsoft.com/Forums/sqlserver/en-US/c5a27692-05c0-4ee4-b97f-1ea438b4e5f7/event-id-10016-issue-in-sql-cluster-server?forum=sqldisasterrecovery
    In addition, if there are any further requirements regarding SQL, here are some SQL forums below for you:
    https://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver&filter=alltypes&sort=lastpostdesc
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • CRITICAL EVENT VIEWER ERROR CODES IN WINDOWS 8 OS HELP!!!!!

    URGENT HELP NEEDED!! HP PAVILION G7 LAPTOP, PRE-INSTALLED OS: WINDOWS 8 UPGRADED TO 8.1 DOWNLOADED FROM WINDOWS.  EVENT VIEWER SHOWING NUMEROUS ERROR ID'S #1 SOURCE: ESENT, EVENT ID: 532, WITH LEVEL:WARNING ON 1/11/14.
    +
    System
    Provider
    Name]
    ESENT
    EventID
    532
    Qualifiers]
    0
    Level
    3
    Task
    1
    Keywords
    0x80000000000000
    TimeCreated
    SystemTime]
    2014-01-11T21:09:31.000000000Z
    EventRecordID
    6382
    Channel
    Application
    Computer
    5CD3182MR2
    Security
    EventData
    LiveComm
    5976
    C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\f3234cb42b8f428e\120712-0049\:
    C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\f3234cb42b8f428e\120712-0049\DBStore\livecomm.edb
    3907584
    (0x00000000003ba000)
    8192
    (0x00002000)
    36
    STATES FAULTY HARDWARE, AND THIS IS A NEW LAPTOP! THERE ARE OTHER ID'S LISTED: EVENT ID:1530, SOURCE: USER PROFILE SERVICE, LOG NAME: APPLICATION, LEVEL:WARNING, 3 USER REGISTRY HANDLES    LEAKED FROM WINDOWS\SYSTEM 32, I DONT
    KNOW WHATS GOING ON?? IT IS MY NORTON 360? I SEE IT SHOWS :3 user registry handles leaked from
    \Registry\User\S-1-5-21-3960481396-744839641-3680832521-500: Process 312
    (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key
    \REGISTRY\USER\S-1-5-21-3960481396-744839641-3680832521-500 Process 752
    (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key
    \REGISTRY\USER\S-1-5-21-3960481396-744839641-3680832521-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
    Process 312 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened
    key
    \REGISTRY\USER\S-1-5-21-3960481396-744839641-3680832521-500\Software\Microsoft\Windows\CurrentVersion\Internet
    Settings\Connections
    PLEASE HELP OR GIVE ME ADVICE, THANK YOU!!

    Please provide us with your Event Viewer administrative logs by following these steps:
    Click Start Menu
    Type eventvwr into Search programs and files (do not hit enter)
    Right click eventvwr.exe and click Run as administrator
    Expand Custom Views
    Click Administrative Events
    Right click Administrative Events
    Save all Events in Custom View As...
    Save them in a folder where you will remember which folder and save as Errors.evtx
    Go to where you saved Errors.evtx
    Right click Errors.evtx -> send to -> compressed (zipped) folder
    Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post
    If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem.
     The work around is to edit the registry.  If you are not comfortable doing this DONT.  If you are, backup the key before you do
    Press Win+"R" and input regedit
    Navigate to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"
    Did you ask this on another site???  It looks very familiar.
    Wanikiya and Dyami--Team Zigzag

  • Windows is Scanning and repairing drive... (- Errors in Event Viewer)

    Long post, please be patient... :)
    I have a fairly new (purchased 8/2013) Lenovo ThinkPad T431s with Windows 8.1 Pro 64-bit (updated from 8.0 -> 8.1). It has a very tricky error coming basically 8 / 10 boots:
    Windows is Scanning and repairing drive...
    Error details from Windows Event Viewer (a new similar error appears on every boot to event viewer):
    A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
    A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference
    number of the file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
    What has been done 1st trying to fix that:
    SSD disk has been changed (image from previous SSD copied back) ->
    no solution, error remains
    chkdsk /F /R -> no solution, error remains
    SFC /scannow -> no solution, error remains
    dism /online /cleanup-image /restorehealth -> no solution, error remains after a few boots
    TRIED using Windows 8.1 "Update & Recovery -> Refresh Your PC without affecting your files" -> Inserted the Lenovo "Operating System Recovery Disk Windows 8 Pro (OEM Activation 3.0 Required)" BUT Windows did not accept
    that DVD claiming "The media inserted is not valid"... ???
    Ended up calling Lenovo Support and they instructed me to order the Recovery DVD from
    Lenovorecovery.com -> Unfortunatelly Windows does not recognice the DVD(s)...
    mountvol returns:
    \\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3}\
    (This is my C:\ drive where Windows installation resides)
    \\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7}\
    *** NO MOUNT POINTS ***
    \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\
    *** NO MOUNT POINTS ***
    \\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897}\
    *** NO MOUNT POINTS ***
    Then running fsutil dirty query on each returns:
    Volume - \\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3} is NOT Dirty
    Volume - \\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7} is NOT Dirty
    Volume - \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} is Dirty
    Volume - \\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897} is NOT Dirty
    The chkdsk on the dirty volume
    \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\ returned:
    The type of the file system is NTFS.
    Insufficient storage available to create either the shadow copy storage file or
    other shadow copy data.
    A snapshot error occured while scanning this drive. Run an offline scan and fix.
    Diskpart output on the same volume:
    DISKPART> lis par
    Partition ### Type Size Offset
    Partition 1 Reserved 128 MB 17 KB
    Partition 2 Recovery 1000 MB 129 MB
    Partition 3 System 260 MB 1129 MB
    Partition 4 Primary 146 GB 1389 MB
    Partition 5 Recovery 350 MB 147 GB
    Partition 6 Recovery 19 GB 148 GB
    Questions:
    1) Are my Partitions OK, haven't "touched" anything?
    2) Excluded the dirty volume from boot checking with chkntfs /x
    -> still the Error appears in Event viewer log (but Scanning is skipped/not shown anymore during the boot).
    What is causing the error?
    3) Why do I have three (3) recovery partitions?

    What has happened in the past days:
    A) Lenovo on-site-Support changed the motherboard -> had no impact on the error (which I expected).
    B) I found
    instructions how to manually create USB Flash stick with a booting Custom (OEM) Recovery Image.
    C) Booted with USB and performed "Refresh your PC without affecting your files."
    D) Windows was refreshed but...
    -->>
    Still the error remains (Windows scanning and repairing drive \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} on each and every boot.
    1) Related Error in Event viewer (NTFS):
    A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
    A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference number of the
    file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
    2) Related Error in Event viewer (NTFS - Microsoft Windows NTFS):
    Volume \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5) needs to be taken offline to perform a Full Chkdsk.  Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via
    PowerShell.
    -->>
    Now Lenovo support is proposing a full re-install (to be performed by myself) of Windows as this is SW issue.
    Summary:
    - Refreshing my T431s with OEM Image does not help
    - The error remains on \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5; Lenovo Recovery partition) OR at least Windows thinks so...

  • Illustrator CC crashes on startup(windows event viewer message included)

    Windows event viewer shows like this...
    System
    Provider
    [ Name]
    Application Error
    EventID
    1000
    [ Qualifiers]
    0
    Level
    2
    Task
    100
    Keywords
    0x80000000000000
    TimeCreated
    [ SystemTime]
    2013-12-09T06:35:08.000000000Z
    EventRecordID
    71639
    Channel
    Application
    Computer
    HPNB-dhleeNB
    Security
    EventData
    Illustrator.exe
    17.0.0.260
    52822426
    ntdll.dll
    6.1.7601.18247
    521ea8e7
    c0000374
    000ce753
    a690
    01cef4a8afb2dd09
    C:\Program Files (x86)\Adobe\Adobe Illustrator CC\Support Files\Contents\Windows\Illustrator.exe
    C:\Windows\SysWOW64\ntdll.dll
    0b8a3ab7-609c-11e3-8e0d-005056c00008
    Please help.

    Problem solved.   Refer to below.
    3 posts
    Nov 25, 2013
    2.AlanDrVita, 
    Nov 26, 2013 9:16 AM   in reply to outdoorz
    Report
    I may have been able to resolve my issue. I held shift while opening Illustrator and opened it in a bare bones mode, then closed it and reopened it without getting the error message. Good luck to you.
    Was this helpful? Yes   No 

  • Essential event viewer bugs with "Forwarded Events" log in Windows Server 2008 R2 and Windows 7

    To my general experience, Windows event viewer is one of the most problematic, faulty management tools in the case of extensive use of its more sophisticated capabilities. The sole description as well as reproduction of some entangled failures would require
    remarkable effort.
    With the "Forwarded Events" log however, the situation becomes particularly worse in that even simple functionality fails and workarounds are difficult to find. That’s what I’ll describe here in order to share my experience with interested users.
    For precision: I’ve extensively used event viewer on a German Windows Server 2008 R2 SP1 (Windows SBS 2011 Standard SP1). The bugs I found on that system, I could reproduce on a German Windows 7 Professional 64-Bit SP1, too.
    Problem 1: Failure of even simple event filtering
    To reproduce this problem, execute these steps on a test machine with any of the two OS mentioned above:
    (i) To prepare log contents, do either of the following:
    (a) populate some events to your local "Forwarded Events" log (most simply by subscribing events from other logs of the same machine; stop subscription if you have collected some events)
    Or
    (b) copy a non-empty log file "ForwardedEvents.evtx" from another machine (with any of the two OS mentioned above) to your test machine and open the file in event viewer.
    (ii) Navigate to your "Forwarded Events" test log and open the filtering dialog. In the "Includes/Excludes Event IDs" field, type: 1-9000. Click OK.
    (iii) Look at the results pane: Surprise, 0 Events! Do you really have no event IDs between 1 and 9000 in your test log?
    (iv) Another example, if you have forwarded security events in your test log: Clear filter, if any previous filter is in place. Open the filtering dialog. In "Keywords" sub-dialog, choose "Audit Success". Click OK.
    (v) Look at the results pane: Surprise, 0 Events! Do you really have no successful security monitoring events in your test log?
    I’ll finish here. If you have a rich variety of events in your test log available, let your imagination run wild to test around. Finally include some simple manually created or modified XPath filters on the XML tab of the filtering dialog. I promise, you’ll
    find a lot of additional strange results.
    Problem 2: Cannot save manually selected events to .evtx file
    Navigate to your "Forwarded Events" test log. In the results pane, select one or more events by highlighting them by mouse clicks. In context menu, choose "Save selected events". In the "save as" dialog, choose file type *.evtx
    and save your file. Open the newly created file in event viewer. Result: Surprise, no events inside the new file!
    Have more fun with forwarded events
    Helmut

    Did you mean that right click Forwarded Event and select "Filter Current Log..."? Since I can filter correct event vai the "Filter Current Log..." in my Lab environment.
    Hi Justin,
    yes, I mean "Filter Current Log ... " (in my German systems: "Aktuelles Protokoll filtern ... ").
    What do you mean with "my Lab environment" exactly?
    In the meantime, I performed additional tests. I copied the "ForwardedEvents.evtx" test file from Server 2008 R2 resp. Windows 7 to
    (i) German Windows 8 Pro 64-Bit RTM
    (ii) German Windows 8.1 Pro 64-Bit, up-to-date
    in order to view and filter the file there.
    Results: Same event viewer problem on Windows 8 RTM, but correct behavior on Windows 8.1!
    Best regards, Helmut

  • Event Viewer errors Windows 8.1

    In the Event Viewer Windows 8.1 have found  the following errors from the source Kenel-EventTracing :
    The following sessions could not start due to the error  0xC000035 :
    Pku2uLog
    NegoLog
    IDLListenLog
    HomeGroupLog
    The laptop Windows 8.1 is in Home Group with other laptop Windows 7 and all looks ok with this Home Group.
    What kind of errors are the a/m and what can be done to correct.
    Thank you in advance for the attention and reply. EWAGOSIA

    You may  run the System File Checker tool (SFC.exe) to scan your system files and to repair missing or corrupted system files.
    S.Sengupta, Windows Entertainment and Connected Home MVP

  • Windows 7 event viewer error after 9.1 update

    *Log Name: Application*
    *Source: Bonjour Service*
    *Date: 4/11/2010 8:06:33 PM*
    *Event ID: 100*
    *Task Category: None*
    *Level: Error*
    *Keywords: Classic*
    *User: N/A*
    *Computer: CHEVYSALES*
    Description:
    *288: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)*
    *Event Xml:*
    *<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">*
    <System>
    *<Provider Name="Bonjour Service" />*
    *<EventID Qualifiers="0">100</EventID>*
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    *<TimeCreated SystemTime="2010-04-12T00:06:33.000000000Z" />*
    <EventRecordID>6692</EventRecordID>
    <Channel>Application</Channel>
    <Computer>CHEVYSALES</Computer>
    *<Security />*
    </System>
    <EventData>
    *<Data>288: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)</Data>*
    </EventData>
    </Event>
    above message in my event viewer since i updated to this lousy release....
    have had bnjour messages before but back with vista last year...new machine running solid and steadt windows 7 64 bit with a reliabilty rating from administrative tools of 10 for past months prior to this update...anyone seeing this and if so is there a fix?
    first few backups took for ever on my iphone 3gs..... most go quickly again now.
    don't sync too many things other than videos.
    tia

    Unfortunately there have been multiple issues with the new version of Bonjour which was distributed with iTunes 9.1. Apple knows & is apparently working on a fix but for now you have a few options which might help.
    1) If you don't need the Bonjour service (i.e. for Apple TV) go into system services (run msconfig from a run command & navigate to the 'services' tab), uncheck Bonjour & reboot. That should disable Bonjour & allow iTunes to run properly.
    If you need Bonjour then either
    1) Disable Bonjour as above, delete it & then download a copy of Bonjour 1.x from the web (you'll have to google for it, last time I posted the link, Apple removed my post). Install that one & all should be well.
    2) Uninstall iTunes 9.1 & Bonjour, get a copy of iTunes 9.0.3 and install that one. That will give you the previous version of Bonjour as well. One warning, if you've opened iTunes since upgrading to 9.1, 9.0.x won't be able to open your library since 9.1 updated the library structure. Check in the iTunes folder for one called "Old libraries" or previous library or something similar & you'll have to open that to get your collection to load.
    Good luck,
    Lil

  • Labview 2010 randomly restarts computer - windows event viewer points to nap agent

    When running my current VI that I am working on, the computer will ranomly reboot. There is no freeze, or blue screen, just a reboot. When examining the windows event viewer after the reboot, the following warning is listed immediately preceding the reboot:
    Event ID 39
    The Network Access Protection Agent was unable to determine which HRAs to request a health certificate from.
    A network change or if GP is configured, a configuration change will prompt further attempts to acquire a health certificate. Otherwise no further attempts will be made.
    Contact the HRA administrator for more information.
    Previous to getting this warning before a reboot, I was getting the following error:
    Event ID 10016
    The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
    {24FF4FDC-1D9F-4195-8C79-0DA39248FF48}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18).  This security permission can be modified using the Component Services administrative tool.
    This is a DCOM service eror and the CLSID is referring to NAPAGENT. So I configured DCOM to allow the NAPAGENT to start and now I get the Event ID 39 warning and still get the reboot.
    I am not sure why labview is even asking for DCOM or NAPAGENT to start at all. My VI is simply reading information from two serial instruments.
    This reboot behavior does not occur when the computer is not running labview.
    I am attaching a copy of the main VI, if it will be helpful I can post the sub VI's as well.
    Thanks in advance for your help.
    -Justin Lee
    Attachments:
    testscan10.8.vi ‏179 KB

    Hi Joe,
    Thanks for the reply.
    I am running windows XP pro service pack 3.
    I am running a standard instal of labview 2010 with the latest VISA drivers, no other modules or options installed.
    I am only reading and writing to the serial ports (com) in my code. I don't believe that virus/spyware/malware is to blame for several reasons.
    1. This only occurs when running this VI in labview.
    2. I have replicated this problem on another computer.
    3. I am behind a government (DOE) firewall and virus scans and checks are performed constantly.
    4. If I take out the serial portion of my code via a T/F case structure, it will not crash.
    The code will run fine for sevetral hours sometimes and then crash, other times it will crash after only a few minutes.
    Please let me know what other information you require.
    Thanks!
    Justin Lee

  • Facebook Security/Active Session Question via iPhone and Safari

    I am running Mac OS 10.8.3 with Safari 6.0.4 on an iMac. On Facebook using Safari, I set up "Login Approvals" which would require a security code. However, every once in a while under the "Active Sessions" I noticed an unknown session from an iOS 6 device from a different location other than the state I live in. I ended that activity. As a test, I accessed my Facebook account using my iPhone 5. I noticed that under Facebook's Active Sessions on Safari on my iMac, it lists my iPhone device as being in a different state. Why is that? Is there some general iPhone setting that I need to change?

    Hi, Thanks for the suggestion!
    To look at the keychain sounds helpful to solve the problem. It seems top be a problem with accessibility. I will have a look. But I also have decided to extend my RAM - since it is very true 128 MB really isn't much.
    Then for clarity:
    I have not followed an email link to download the security upgrade, but I used the usual software update manager - I just didn't find the proper english description, since my eMac talks german with me.
    I had had a look into some protokolls "system.log" - well I don't understand much what is written down there. There I might have got the confusion about the security server.
    There are several lines with Safari, like this one:
    date + time: localhost/Applications/Safari.app/Contens/MacOS/Safari:
    InitializeDiskArbitrationMessages: DiskArbitraitionRegister failed 1102
    The same is noticed about Mail
    These messages are followed by several lines telling:
    date + time: localhost lookupd[623]: NetInfo connection failed for server 127.0.0.1/local
    But I am afraid, I don't really know what this means.

  • Windows 8.1 event viewer logs.

    I am looking for the windows 8.1 event viewer logs and settings, online search fails to produce answer, and suggested .msc commands are not valid. 

    Hi @butface ,
    Thank you for visiting the HP Support Forums and Welcome. I have looked into your issue with your Windows 8.1 and the event viewer. Here is how to open Event Viewer by clicking the Start button, clicking Control Panel, clicking System and Security, clicking Administrative Tools, and then double-clicking Event Viewer.
    I would be happy to assist if needed as there are many models of HP Notebook ,
    I would need the model number. How Do I Find My Model Number or Product Number?
    Please let me know.
    Thanks.
    Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
    Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

  • Windows Server 2008 R2 Security Event Log Maximum Size

    I have a customer with logging requirements on domain controllers that are exceeding the maximum log size they have configured for the security log.  When they attempted to increase the maximum size of the security event log via Group Policy, the settings
    did not take effect.  When an attempt was made to increase the security event log manually on the domain controller via the properties of the log, an error is generated whenever the value was changed.
    The Maximum Log Size specified is not valid.  It is too large or too small. The Maximum Log Size will be set to the following: 196608 KB
    The 196608 KB value is the value that it is currently set at.  Testing on other logs, application, system, has lead to the same result.  
    wevtutil.exe sl security /ms:<n> produces similar results.  There is no error message given but the value doesn't change when you run wevtutil.exe gl security
    When viewing the registry value MaxSize under HKLM\Current Control Set\Services\EventLog\Security the change is reflected, but the log does not seem to get any larger.  
    What one would expect to be a two minute change in a group policy object has turned into something much more difficult.  Any idea what could be causing this?
    Joseph M. Durnal MCM: Exchange 2010 MCITP: Enterprise Messaging Administrator, Exchange 2010 MCITP: Enterprise Messaging Administrator, MCITP: Enterprise Administrator

    I verified that it was not another policy - the domain is pretty simple without many policies, only policies applied are:
    Default Domain Policy (no event log settings)
    Company Domain Policy (no event log settings)
    Default Domain Controller Policy (no event logs settings)
    Company Domain Controller Policy (...\Event Log\Maximum security log size 4194240 kilobytes)
    The value was 196608 before, the plan was to change the group policy setting to 4194240 and I expected it to be that easy.  However, the values didn't change.
    4194240 is divisible by 64
    Used multiple tools to try and change
    Group Policy
    Event Viewer
    wevtutil.exe
    registry editor
    While some of the methods display a larger event log, the actual size of the event log still seems to be limited to 196608 kb.  
    Thanks,
    Joe
    Joseph M. Durnal MCM: Exchange 2010 MCITP: Enterprise Messaging Administrator, Exchange 2010 MCITP: Enterprise Messaging Administrator, MCITP: Enterprise Administrator

Maybe you are looking for