Copying the SecEvent.Evt file

[Johnny Mac]

Can anyone tell me how to copy a SecEvent.evt file
(C\Windows\system32-config\) to another location so I can view it using Event
Manager. When I perform a typical copy and paste and I view the file using
Event Manager the file is always corrupt.

A million thanks
Johnny Mac

 

[John John - MVP]

You can save the file to another location from within the Event Viewer.

John

 

[Johnny Mac]

I am trying to automate the copy or move processes of the SecEvent.Evt file,
using a logoff script or personally created bat file. Using Event Viewer
requires a human to be behind the mose/keyboard and is more of a manual
processes which I am trying to avoid.

I know the main problem is the SecEvent.Evt file is a active file
(constantly in use by the OS since it is being writtent too) and requires
applications (Like Event Viewer) to review or move the file. In this case
application (Like Event Viewer) is more like a proxy which supports the
request versus a traditional "copy / paste" of a file.

Any additional ideas?

Thanks Johnny Mac

 

[John John - MVP]

The guys in the scripting groups should be able to give you a WMI script
to do this. Or this should do the trick for you:

http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx
PsLogList

John