«

I had read that you were only supposed to be able to save event logs (.evt
format) to the local hard drive. However I was just able to save to remote
machine using mapped drive and a UNC path? This was done from windows server
2k3 sp1. Maybe this change was with sp1? anyone know?

I also cross-posted to the cert groups because I was wondering how to handle
this type of thing on a test... for example, book says you can't, hands on
testing says you can....

David,

The Windows Resource Kit has a tool called elogdump which does this, but
PsLogList does this just fine.

http://www.microsoft.com/technet/sys...PsLogList.mspx

Either one works fine.

Bill F.

"David" <> wrote in message
news:%23mL$...
>I had read that you were only supposed to be able to save event logs (.evt
>format) to the local hard drive. However I was just able to save to remote
>machine using mapped drive and a UNC path? This was done from windows
>server 2k3 sp1. Maybe this change was with sp1? anyone know?
>
> I also cross-posted to the cert groups because I was wondering how to
> handle this type of thing on a test... for example, book says you can't,
> hands on testing says you can....
>

"David" <> wrote in message
news:%23mL$...
>I had read that you were only supposed to be able to save event logs (.evt
>format) to the local hard drive. However I was just able to save to remote
>machine using mapped drive and a UNC path? This was done from windows
>server 2k3 sp1. Maybe this change was with sp1? anyone know?
>
> I also cross-posted to the cert groups because I was wondering how to
> handle this type of thing on a test... for example, book says you can't,
> hands on testing says you can....

I believe you've always been able to *export* / save the event log file to a
network drive.

I would expect the cert question would be asking whether you can permanently
*move* the location of the original log file to a network drive, which you
should not be able to do.


--
kind regards,
Karl Levinson, MS MVP
Security FAQ site:
http://securityadmin.info