PowerShell: How to clear all Event Logs

Run PowerShell as an administrator and use example:

wevtutil el | Foreach-Object {wevtutil cl "$_"}

Warining! Command will clear ALL events on ALL event logs!



/Geecoholic

Windows 2012 R2 restarts after lsass.exe crash

Description

We have Windows 2012 R2 server with Active Directory role, which  1-2 times in the day starts automatically restart after recorded events 1000 and 1015 to event log:

Log Name:      Application
Source:        Application Error
Date:          3/9/2016 4:37:41 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
Faulting application name: lsass.exe, version: 6.3.9600.17415, time stamp: 0x545042fe
Faulting module name: ntdsai.dll, version: 6.3.9600.18009, time stamp: 0x55c8e51c
Exception code: 0xc0000005
Fault offset: 0x0000000000219d67
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Faulting package full name: %14
Faulting package-relative application ID: %15


Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          3/9/2016 4:37:49 PM
Event ID:      1015
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.



Solution

Server have all up to date fixes until 2/23/2016 and official MS KB2914387 dont' help, because  DLL file Ntdsai.dll noticed in hotfix is older and server already have more fresh version of that DLL.

We found source of restarts - OOMADs.msi(Active Directory Management Pack Helper Object) was recently installed to provide Active Directory monitoring for SCOM agent. After OOMADs.msi uninstall problem gone.

/Geecoholic

EventLog: DNS Client Stopped every 20 min, Event ID 7074

Description

I have a problem with a two Windows Server 2012 R2 with restricted network configuration. About every 20 minutes the DNS Client stopped or started with event ID 7076 in system event log. Here are examples of evens:

Log Name:      System
Source:        Service Control Manager
Date:          3/16/2016 5:43:55 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
The DNS Client service entered the running state.

Log Name:      System
Source:        Service Control Manager
Date:          3/16/2016 5:43:55 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
The DNS Client service entered the stopped state.

Log Name:      System
Source:        Service Control Manager
Date:          3/16/2016 5:23:55 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
The DNS Client service entered the running state.


Solutions

• Disable DNS Client(dnscache) service

or

• Unblock the firewall rule "Network Discovery (LLMNR-UDP-In)" in the active profile.

/Geecoholic

EventLog: Who and when restarted/shutdowned computer

Here the Sysem event ID's that shows computer restart/shutdown and when started on all Windows family Windows 2003/XP, Windows Vista/7/2008, Windows 8/10/2012:

1074, 6005

Here typical example of Evend ID 1074 generated after windows updates install and automatically restart(shows time, user, type):

Log Name:      System
Source:        User32
Date:          2/28/2016 1:57:06 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      COMPUTERNAME.DOMAIN
Description:
The process C:\Windows\system32\svchost.exe (COMPUTERNAME) has initiated the restart of computer COMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
 Reason Code: 0x80020002
 Shutdown Type: restart


Here typical example of Evend ID 6005 generated whane computer starts(shows time):

Log Name:      System
Source:        EventLog
Date:          2/28/2016 1:59:18 AM
Event ID:      6005
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      COMPUTERNAME.DOMAIN
Description:
The Event log service was started.


Estimated computer downtime can be calculated from time differences between Date fields in both example logs:
1:57:06 AM minus 1:59:18 AM = 2 min 6 sec

Official MS information on 6005 and 1074 ID's.

/Geecoholic