Solved

Dump NPS logs

Posted on 2014-11-20
14
377 Views
Last Modified: 2014-11-22
How can I dump the events or logs for "Network Policy and Access Services" to a text file ?
0
Comment
Question by:soffcec
  • 7
  • 7
14 Comments
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
Manually, you can navigate to any event log, right-click and do a "Save All Events As."  Your Save As options are:

1. evtx
2. xml
3. txt
4. csv

Or are you looking for a script?

Dan
0
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
If you are looking for events with specific event IDs or from a specific source, you can go to the appropriate event log and use the "Filter Current Log" function to select the desired events.  After finding the desired info, use the "Save Filtered Log File As" function to drop those events into files types mentioned above.

Dan
0
 

Author Comment

by:soffcec
Comment Utility
Well I need script for this, if have been trying to use wevtutil  and netsh, but not found a way to dump the NPS events.
0
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
Have you tried using the plain old Event Viewer?  My posts above are based on using it.

Are you comfortable with PowerShell?

Dan
0
 

Author Comment

by:soffcec
Comment Utility
Yes, but I need to schedule the running of the event dump. PS is ok. I have done this for long time in Windows 2003 but I cant find out how to do this in Windows 2012R2 and I only need the logs for the NPS
0
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
OK, so a litte more info is needed:

1. the scheduled task is run how often?
2. what timeframe should be in the output file?  last 24 hours, last 12h, or all...
3. what event ids or what event source are you looking for?
--- I understand NPS events, but since you've done it before it would be helpful to now exactly what you pulled
4. CSV format?

Dan
0
 

Author Comment

by:soffcec
Comment Utility
Don´t worry about the schedule, I just need wevtutil  and netsh command syntax to dump the NPS events to text file, no matter what format (.cvs,.txt)
I have never dumps NPS events in Server 2003, this is the first time I try to dump them.
On the 2003 server I was dumping other events.
0
Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
Have you enabled NPS logging?

Link: http://msdn.microsoft.com/en-us/library/cc730677.aspx

If so, it logs to a text located, by default, at:  systemroot \System32\LogFiles.  You can configure this log to rotate on the regular basis.  See above link.

Here is the netsh nps command reference:  http://technet.microsoft.com/en-us/library/cc754758(v=ws.10).aspx

Here is the wevtutil command reference:  http://technet.microsoft.com/de-de/library/cc732848(v=ws.10).aspx

Dan
0
 

Author Comment

by:soffcec
Comment Utility
The NPS logging does not log anything, I prefer to use the event viewer logs.

I have checked out both aobove links before, As I said, I need the syntax for netsh or wevtutil to dump the event viwer NPS
0
 
LVL 26

Accepted Solution

by:
Dan McFadden earned 500 total points
Comment Utility
The links I posted provide you with the command reference, aka syntax.

If you want the actual command to dump the events, you have to answer a previous post where I asked what events ID you are looking for.  There are more than 100 unique events that are logged in the security event log.

Below is the XML for a custom event filter.

<QueryList>
 <Query Id=”0″ Path=”Security”>
 <Select Path=”Security”>*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 12552]]</Select>
 </Query>
 </QueryList>

Open in new window


Save that to an .xml file, then import it into the "Custom Views" in the Event Viewer to see if you get the results you want.  If that works for you, use the command below to get the events with wevtutil:

wevtutil qe c:\test\NpsQuery.xml /sq:true /f:text > NpsQuery.txt

Open in new window

0
 

Author Comment

by:soffcec
Comment Utility
Humm , not undestandig this error,

C:\Netuse>wevtutil qe NpsQuery.xml /sq:true /f:text
Failed to open event query. The specified xml text was not well-formed. See Extended Error for more details.
0
 
LVL 26

Expert Comment

by:Dan McFadden
Comment Utility
Error is from the way the xml file content was saved.  I'll guess you used Notepad to save the file.  I suggest that you use another text editor like Notepad++ or Programmer's notepad, either of these text editors will save the file properly.

Dan
0
 

Author Comment

by:soffcec
Comment Utility
Now I have tried to save the text with EditPlus and Notepad++ but get the same error

When I try to import to Custom View I get the error "The specified custom view is not valid."
0
 

Author Comment

by:soffcec
Comment Utility
It is working now. I replaced the double quote with double quote.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now