B
bucrepus
I have eventviewer set to archive security logs (auditing a user). I load an archive in eventviewer and filter it. If I export the filtered events to a TEXT, CSV or XML the export has all records in it but the dates are all the same. (Actually the date in the export is always the last date of the last record in the archive). The times match the .evtx records but not the date. This only happens with archived event logs; an export with the live log doesn't do this. I have tried this on two 2016 servers; they do the same on both. They are all patched to current updates.
Continue reading...
Continue reading...