Need to monior a Event ID which presents in Applications and Services Eventlog.

Hi All,

Can anyone please help on the below request.

Need to monior a Event ID which presents in Applications and Services Eventlog.

The logs is stored locally under the following path (%SystemRoot%\System32\winevt\logs) …but this will be in a .evt format by default.



  • Hi, Thanks for the solution given, but it works only for the Event log names of Security, application and system. I have attached a document where i need to configure the policy for Event ID which is present in the folder Microsoft-Windows-TerminalServices-SessionBroker which is under log name of Applications and Services. Can you please help on the same for. Regards Kamal
  • Hi Kamal,

    You can monitor a different log by entering the name shown in the "source of" field of the event. For example, to monitor Event ID 1149 from TerminalServices Remote Connection Manager log just change the default "Event log name" value to TerminalServices-RemoteConnectionManager and the policy will go to default Windows EVT path %SystemRoot%\system32\winevt\logs where all logs under Applications and Services Logs are saved.

    Hope this helps,


  • Hi Advisor, I have done the policy configuration as you said Attached the screenshot of the same. Can you please check and let us know is the configuration i had is correct or not? Attached the screenshot of the policy which I have created and the event id which to be configured. Regards Kamal
  • Hi Kamal,

    I am unable to find the attached file. Can you check and upload it again? Do you already tried deploying the policy with the "Send message if event log does not exist" option?

    Looking forward to your comments,


    Juan Sobrado

    OMW Technical Support Consultant

Reply Children
No Data