Event log contents by email on an event log trigger

Scenario: You need to get an alert email for specific events occurred on the critical / production server.


Step 1:

Identify the event which you need to trigger






Step 2: Go to Task scheduler and select the Event viewer tasks & create a new task.







Step 3:  Name the task and select “Run whether user logged on or not” & “Run with highest privilges”








Step 4: Go to triggers and select the option begin the task “On an Event” & select the option as per screenshot







Go to actions and need to perform two actions

  1. Query a script which will create a copy of the required event in text and make an action in the scheduler.

Script to run : save the below as Query.cmd

del %temp%\Logonfailure.txt

wevtutil query-events Security /rd:true /format:text /q:”Event[System[(EventID=4625)]]” > %temp%\Logonfailure.txt








2. Create another action for sending email with the required recipient and attachment of the query log








Output will be









When we do data migration from one server to another server we will use fast copy or robocopy to get the same ACL in the target server or storage.

Some times the ACL will not get inherited to the sub folders or files, even when we try to do reset permission in the advanced tab in the security menu.

The following is the syntax to reset the folder permission in command mode.

icacls “Folder path\*” /T  /L  /Q /C /RESET

or you can download the GUI tool which will do the NTFS permission reset (i.e.) the permission will be applied to the sub folders and files successfully.

Url: https://www.dropbox.com/s/ipblchbgrzz4587/ResetPermission.zip?dl=0




Trust Relationship Across forest in Active directory


I hereby enclosing the procedure in step by step pdf format for implementing trust relationship across forest in Active directory…


Trust relationship – Two different Forest

Hyper-V installation in Vsphere 5.1

To install Hyper-V in an Esx server, the following requirements to be done before the installation of Windows2012 OS.


If you are using vSphere 5 or greater then you need to modify the vmware config file on the ESXi host that will run the Hyper-V virtual machine. To edit this file, ssh to the server and vi /etc/config/vmware. Add the line vhv.allow = “TRUE” to the file and save it with “wq”.

Hyper-V cannot be installed-2

Step-2: In the .VMX config file, path /vmfs/volumes/datastores/VMfolder (HyperV-VM), adding these 4 lines:

mce.enable = "TRUE"
hypervisor.cpuid.v0 = "FALSE"
featMask.vm.hv.capable = "Min:1"
vhv.enable = "TRUE"

Alternatively, you should change the suffice guestOS line to
guestOS = "winhyperv" in the .vmx config file and save the file.

Now the Hyper-V VM can be successfully power on without any issues.


For more info : http://www.tinkertry.com/vmware-esxi-5-1-can-run-microsoft-hyper-v-server-2012-vms-nice/



Installation of Hyper-V Windows2012

When you install Hyper-V in windows 2012 in the add and remove roles you will get an error message “Hyper-V cannot be installed: A hypervisor is already running. Refer screen shot below.











The first thing you need to do is to open and change the PowerShell execution policy scripts to RemoteSigned then run the following command to install the Hyper-V :

C:\> Get-ExcutionPolicy

c:\>Enable-WindowsOptionalFeature –Online -FeatureName Microsoft-Hyper-V –All -NoRestart

The above command installs only the hypervisor but does not install the administration tools, so you can manage the Hyper-V within the virtual machine you must install RSAT for Hyper-V to do this run the following command:

c:\> Install-WindowsFeature RSAT-Hyper-V-Tools -IncludeAllSubFeature


Now I suppose you want to create a cluster then you need to install the Cluster service,  run:

c:\>Install-WindowsFeature RSAT-Clustering -IncludeAllSubFeature


Optionally you can install Multipath I/O to enable multiple paths to the storage, if this is your case follow:

c:\>Install-WindowsFeature Multipath-IO

Then restart Computer



Windows2012 Hyper-V successfully installed.

Wmic command for memorychip

To identify physical memory usage and free dim slots available in a server or desktop wmic command plays a major role

Some of the examples are given below










For more info

Wmic memorychip



An error was detected on device \Device\Harddisk1\DR1 during a paging operation.

Error in VM:

Event log error-id: 51

Error message “An error was detected on device \Device\Harddisk1\DR1 during a paging operation.”

In the backup error log “It was not possible to create volume snapshot for ‘E:\’. System error: ‘QueryStatus() failed’.”


Cause: Microsoft provides hot fix for the VSS issue for windows 7 and Windows2008r2 which was not installed.

Solution: Install the two hotfix provided by Microsoft

1.       Windows6.1-KB975688-x64.msu

2.       Windows6.1-KB976099-x64.msu

Patch download url : https://www.dropbox.com/sh/m3lca0905tnt5fe/GbJ5bOZ1cz



This solves the problem.