Windows 10: TimeStamp In Security Events

I came across a weird issue of timestamp in security events.When I am fetching the logs to SIEM system via RPC, the raw event that I see has a field called TimeCreated. The value of this fields looks like epoch time however, when I am converting the timestamp, it doesn't match up with the TimeStamp displayed in the event viewer console.

:)

 

Windows 10 timestamps

Hi,



Thank you for posting your query in Microsoft Community.



I can understand, how frustrating it can be, when things don’t work as expected.

I'd be glad to help you.



Please answer the queries, mentioned below:

• 
  Were you able to install Windows 10 successfully?
  
• 
  Did you check, if it is present in Windows.old folder?
  
• 
  Where exactly are you trying to check, if the TimeStamps are present?
  

I would suggest you to follow these steps below to retrieve files manually from Windows.old folder and check, if it helps.

• Enter This PC in the search box, and then click on
  This PC in the search results.
• Double-tap or double-click the drive that Windows is installed on (typically, the C: drive).
• Double-tap or double-click the Windows.old folder.
• Double-tap or double-click the Users folder.
• Double-tap or double-click your user
  name.
• Open the Windows.old folder that contain the files you want to retrieve.
• Copy and paste the files that you want from
  Windows.old folder to a folder in Windows 10.
• Repeat steps 5-7 for each user account on your PC.

Please feel free to contact us if you face any issues with Windows.

Thank you.

 

Corporate Security Solution

That made me so facepalm. Some people have absolutely no clue. I hope they don't take you for granted with all this you're doing for them.

SonicWall is a good security product, so Mindweaver's suggestion sounds like a good one and should make for a rather bigger baby step. Let's hope they take it.

 

AMD External events client module stopped working

Hi Jignesh,

I suggest you to follow the below methods and check if it helps.

Method 1: I suggest you to follow below steps and check.

Step 1: I suggest you to install all the latest pending Windows updates as below and check if it helps.

• Go to “settings” and click on “update and security”.
• Under tab “Windows update”, click on the icon “check for updates”.
• Then once you find the pending updates install it and check.

Step 2: I recommend you to download the Microsoft Safety Scanner from the following link and check if it helps.

http://www.microsoft.com/security/scanner/en-gb/default.aspx

Note: The Microsoft Safety Scanner is a free downloadable security tool that provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software.

Disclaimer: Any data files that are infected may only be cleaned by deleting the file entirely, which means there is a potential for data loss.

Method 2: To remove AMD External Events service Module from your computer, please follow the manual instructions below or use an automatic uninstaller product.

• Click the Windows Start Button. In Windows 8, look for Control Panel.
• Click Control Panel.
• Click Uninstall a program.
• Look for AMD External Events in the list of available programs.
• Click Uninstall.

Please get back to us with an update on this issue, we will be happy to assist you further.

Thank you