Windows 10: Winlogon event id 801/802 not coming under Microsoft-Windows-Winlogon event viewer.

Hi All, I am looking for event id 801/802 under Microsoft-Windows-Winlogon.These events corresponds to "NotifyExecute" as mentioned here :https://raw.githubusercontent.com/repnz/etw-providers-docs/master/Manifests-Win10-17134/Microsoft-Windows-Winlogon.xmlOther event like 811/812 are coming as we can see following sample:Information 24-03-2023 14:34:12 Winlogon 811 811The winlogon notification subscriber <TermSrv> began handling the notification event 5.Can anyone help here on how can we get those 801/802 events. Do I need to set som

:)

 

EVENT ID 7001 - Winlogon ??

<Hello, I received an e-mail in my google account today that my Facebook account was recently logged into from a new browser or device (It says google chrome). Then I went to Event Viewer
and have seen that in particular time there really were events listed under that time and date for my PC. I also found event ID 7001. Does that really mean that my PC was turned on during that time ??? I posted xml file of my 7001 event, please answer.

Opcode>0</Opcode>

<Keywords>0x2000200000000000</Keywords>

<TimeCreated
SystemTime="2016-02-22T09:32:36.308491300Z" />

<EventRecordID>5006</EventRecordID>

<Correlation
/>

<Execution
ProcessID="8888" ThreadID="1976" />

<Channel>System</Channel>

<Computer>DESKTOP-OTMVUMC</Computer>

<Security
UserID="S-1-5-18" />

</System>

L: -
<EventData>

<Data Name="TSId">3</Data>

<Data Name="UserSid">S-1-5-21-3642567962-1725337173-575369333-1001</Data>

</EventData>

</Event>

 

Event viewer error with event id 10016

Hello,

Thank you for posting your query on Microsoft Community forum.

I understand that you are getting an error “DistributedCOM 10016” in the event viewer logs.

• Do you face any issues on the computer?
  
• Have you made any recent changes to the computer?

This problem may occur if either of the following conditions is true:

• A program with the class ID (CLSID) that appears in the message tries to start the COM component by using the DCOM infrastructure. However, the user does not have the required permissions to start the COM component.

• The Network Service account does not have the correct permissions.

Event logs are special files that record significant events on your computer, such as when a user logs on to the computer or when a program encounters an error. Whenever these types of events occur, Windows records the event in
an event log that you can read by using Event Viewer. Advanced users might find the details in event logs helpful when troubleshooting problems with Windows and other programs.

If you do not have any issues with app or any other program I would suggest you to ignore it.

Keep us posted if you face any issues related to Windows in future. We will be glad to help you.

 

Error in event viewer

Hi

I keep geting the following in the Event viewer ,
The description for Event ID (4) in source ( SuperProServer ) cannot be found . the local computer may not have the necessary registry information or message DLL files to display message from a remote computer . You may be able to use /AUXSOURCE= flag to retrieve this description . The following information is part of the event, The event log file is corrupt .

has anyone any ideas has to what this means .

cheers