Zoho Banner September 2011

Archive for November, 2008

Windows Server 2008 (and Vista) offer improved options for event log management.  For example, you now have the option to forward events to a central event collector server.  You also now have powerful filtering capabilities.  One of the features I like is the Wevtutil command-line tool that allows you to retrieve, query, archive, export and clear events.   It’s the best option you have if you use Server Core and don’t want to open the firewall to allow remote access using the Event Viewer UI.

Recently, I had to schedule the export of events using Wevtutil using a time-based query.  It took me a little while to get the query syntax right, so I thought I would share it with you here.

Let’s take a scenario in which you want to export all events from in the past 24 hours from the security log to a *.evtx file.  (Note. The default format for exported event log files in Vista and Windows Server 2008 is *.evtx.  For a good explanation of the differences between evt and evtx see this blog entry).   You can leverage the Windows Event Viewer (eventvwr) to assist you with obtaining the query required to filter the log to show only events from the past 24 hours.  To do this, click on your event log of choice (in this case Security).  In the right-hand action pane click Filter Current Log.  Within the Filter tab, select the drop-down list next to Logged and choose Last 24 hours.  Now click on the XML tab.   The query is embedded within the XML content, as follows:

 *[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]


The Wevtutil command to use the filter is shown below (may wrap).

wevtutil.exe epl Security C:\SecurityLog24hours.evtx “/q:*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]” /ow:true

Note that you have to replace the “&lt;” escape sequence meaning “less than” from the XML original with the “<” character, otherwise the query does not work and you will receive the error:

Failed to export log Security. The specified query is invalid.

The time-based filter I have used in this example only scratches the surface of the query capabilities you have with Wevtutil.  The fact that you can leverage the capabilities within the Event Viewer UI to assist with building the queries takes a lot of the pain away.  For more information about Wevtutil, including all the available command line options, see this page on Microsoft Technet.

If you’ve played around with Windows Server 2008 Active Directory Domain Services, you will probably be familiar with the snapshot feature within NTDSUTIL.  The feature allows you to take snapshot of the volumes that host the AD components and to then mount the snapshot.  Once mounted, you can use DSAMAIN.EXE to expose a read-only copy of the AD database to your favourite browsing tool (LDP.EXE, ADSIEDIT.MSC, DSA.MSC, ADFIND.EXE, etc.).  The process for doing this is well documented elsewhere, so I don’t intend to reproduce it here. 


Microsoft recommends that you schedule regular snapshots, as this provides you with a quick method of checking the contents of the directory at different time slices in the past.  One advantage of this that you can quickly identify which backup to use when needing to authoritatively restore accidentally deleted AD objects from backup.


What isn’t quite so well documented it the process to schedule regular snapshots.  It took me a little while to configure this properly, so I thought I would share it with you here.


Windows Server 2008 comes with a re-vamped Task Scheduler.  You can configure tasks using both the UI as well as the command line (schtasks.exe).  I prefer to use the command line as it has the advantage of allowing you to set tasks to run under the SYSTEM account.  It is also the only option if you are using Server Core, unless you want to open the firewall to allow remote task scheduling from a computer running the full version.


Here’s the command line I use. Note that it’s all on one line – wrapped here to fit page


 /TR "%windir%\system32\ntdsutil.exe sn \"ac i ntds\" create q q" /ST 05:00

It is worth pulling the command arguments apart to explain them better:


/Create - pretty obvious.  It instructs schtasks to create a new task.

/RU SYSTEM – the task will run under the SYSTEM account.  Note that you don’t need to specify a password when using SYSTEM.

/SC DAILY- the task will run daily

/TN MYTASKS\DS_SNAPSHOT - I’ve called the task name DS_SNAPSHOT and this will be created within the MYTASKS task folder.  The folder will be created automatically if it does not already exist.

/TR “%windir%\system32\ntdsutil.exe sn \”ac i ntds\” create q q” – This is the task action.  It runs NTDSUTIL with arguments.  Note that the double quotation marks within the arguments have to be escaped with the backslash character

/ST 05:00the start time for the task will be 5am.


The command line shown above assumes that you are working on the local machine on which you want to create the task.  If defining the task for a remote computer, use the additional command line options shown below.


 /TR "%windir%\system32\ntdsutil.exe sn \"ac i ntds\" create q q" /ST 05:00

Once you’ve run the command you can verify the settings in the Task Scheduler UI.


If you’re feeling brave you can also have a look at scripting the task creation, as described here.


Since the 24th October I’d been getting the error “Invalid Update Control CTF File” when trying to update AVG 8.0 on my home PC.  I think I remember having this before and it went away after a few days, so I had been ignoring it until today.

Anyway, I found two control files for AVG in the folder “C:\ProgramData\avg8\update\download”, as shown below


I simply renamed them both and then selected “Update Now” after right-clicking the AVG icon on the application tray. 


The update applied successfully and now all is well.  :-)