|
|
|
|
|
|||||||
 |
MCSE - saving event log to remote machine? |
|
|
Thread Tools | Search this Thread |
11-16-2006, 06:45 PM
|
#1 |
saving event log to remote machine?
I had read that you were only supposed to be able to save event logs (.evt
format) to the local hard drive. However I was just able to save to remote machine using mapped drive and a UNC path? This was done from windows server 2k3 sp1. Maybe this change was with sp1? anyone know? I also cross-posted to the cert groups because I was wondering how to handle this type of thing on a test... for example, book says you can't, hands on testing says you can.... David |
|
|
|
11-17-2006, 05:16 AM
|
#2 |
|
Posts: n/a
|
Re: saving event log to remote machine?
David,
The Windows Resource Kit has a tool called elogdump which does this, but PsLogList does this just fine. http://www.microsoft.com/technet/sys...PsLogList.mspx Either one works fine. Bill F. "David" <> wrote in message news:%23mL$... >I had read that you were only supposed to be able to save event logs (.evt >format) to the local hard drive. However I was just able to save to remote >machine using mapped drive and a UNC path? This was done from windows >server 2k3 sp1. Maybe this change was with sp1? anyone know? > > I also cross-posted to the cert groups because I was wondering how to > handle this type of thing on a test... for example, book says you can't, > hands on testing says you can.... > |
|
|
|
11-20-2006, 04:25 PM
|
#3 |
|
Posts: n/a
|
Re: saving event log to remote machine?
"David" <> wrote in message
news:%23mL$... >I had read that you were only supposed to be able to save event logs (.evt >format) to the local hard drive. However I was just able to save to remote >machine using mapped drive and a UNC path? This was done from windows >server 2k3 sp1. Maybe this change was with sp1? anyone know? > > I also cross-posted to the cert groups because I was wondering how to > handle this type of thing on a test... for example, book says you can't, > hands on testing says you can.... I believe you've always been able to *export* / save the event log file to a network drive. I would expect the cert question would be asking whether you can permanently *move* the location of the original log file to a network drive, which you should not be able to do. -- kind regards, Karl Levinson, MS MVP Security FAQ site: http://securityadmin.info |
|
|
