Parsing the Windows logs for a Specific User.

Sometimes you need to know each time a user did something like logged in during a time period. Since the logs can be quite large, I’ve used this method to get results pretty fast. You will need Microsoft’s Log Parser 2.2 installed to use this query. In this case I have it set to look for the name Jeff, but that can be changed to any name.

 

 

 

logparser “SELECT TimeGenerated, SID, Message FROM Security, Application, System WHERE Message like ‘%jeff%’” -i:EVT -resolveSIDs ON > c:\logresult.txt

Create a Dummy File for Testing

Sometimes you just need a specific sized file for something. For instance testing FTP transfers. This handy command line tool will create a file of any size for you. Just open a command prompt and type the following:

fsutil file creatnew myfile.txt <size>

You can replace myfile.txt with any file name and extension. Size will need to be a number in bytes. So for a 1GB file you can use 1073741824.

fsutil file createnew myfile.txt 1073741824

East Trail and Maple Trail at Lost Maples


We woke up to heavy rain and thunder in the morning. I noticed all the appliances had flashing times on them so we lost power over night. Our alarm clocks are cell phones though, so we ended up waking up on time. I checked NOAA weather and the storm zone already passed over our destination near Vanderpool, TX so the 80% rain prediction had been reduced to 30%. We still had to drive through about an hour of rain though before we were out of the storm cell.

Install IIS6 to Somewhere Other than C:

Create a text file and name it answer.txt. Save it in a location that can be easily accessed via the command line. The root of the alternate partition is a good place. For this example we will install IIS on a partition that has been assigned the letter “D” Paste the information below inside the answer.txt file and save it.

[Components]
iis_common = on
iis_inetmgr = on
iis_www = on
iis_ftp = on
iis_smtp = on
iis_asp = on
aspnet= on

[InternetServer]
PathFTPRoot=”D:\InetPub\FTPRoot”
PathWWWRoot=”D:\InetPub\wwwroot”

Launch a command prompt and run the following command:

sysocmgr.exe /i:sysoc.inf /u:D:\answer.txt

If for some reason sysocmgr is not in the path you may need to run the command from within the system32 dirctory.