No event is added to the System log or to an operational channel when you delete or cancel a print job on a computer that is running one of the following operating systems:

• Windows Vista
• Windows Server 2008
• Windows 7
• Windows Server 2008 R2

Therefore, you do not know whether the print job is deleted or canceled when you monitor the status of a queued print job by using the System log or the operational channel.

An application or service subscribes to some events that are in multiple event logs by using Windows Management Instrumentation (WMI) or Windows APIs on a computer that is running Windows Server 2008 or Windows Vista.

In this scenario, the application or service may miss some expected events. This issue causes function failure in the application or service.

For example, an application subscribes to an event to monitor the user accounts that are created. Because of this issue, some newly created user accounts are not detected by this application.

You develop an application that subscribes to ISensLogon interface events. However, when you run the application in Windows Vista or in Windows Server 2008, the application stops receiving logon or logoff event notifications after you log off the operating system.

In a network environment, you run an application to monitor a computer that runs Windows Vista or Windows Server 2008. The application, such as Microsoft Operations Manager (MOM) 2005, SQL Server Management Studio, or .NET, uses an event log API in legacy Windows. However, the application does not receive event information in a readable format.

The affected event logs include the following:

• Descriptions of Application log events from the Microsoft-Windows-RestartManager source.
• Descriptions of Application log events from the Microsoft-Windows-ApplicationExperienceInfrastructure source.
• Descriptions of System log events from the Service Control Manager source.
• Descriptions of System log events from the Microsoft-Windows-TBS source.

Note: The hotfix that is mentioned in Knowledge Base article 961099 addresses the event sources that are related to Security event log. These event sources include the following:

• Microsoft-Windows-Security-Auditing
• Microsoft-Windows-Eventlog

On a computer that is running a 64-bit version of Windows Server 2008 or of Windows Vista, you run a 32-bit application that logs a custom event. When you try to view this event in Event Viewer, you notice that the event is logged incorrectly. For example, Event Viewer displays a message that states the following:

The description for Event ID 261 from source LogSample cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

This problem does not occur on 64-bit versions of Windows Server 2003 or of Windows XP.

Consider the following scenario. You try to deploy some ActiveX controls on a network. In order to deploy and update these ActiveX controls in a standard user environment, you use the ActiveX Installer service on the client computers. However, you may be unable to install the ActiveX controls in a standard user environment. Additionally, an event that resembles the following is logged in the Application log:

Log Name: Application
Source: AxInstallService
Date: Data
Event ID: 4100
Description: Failed to download ActiveX control

Note: This issue occurs only when you use NTLM authentication between the client computer and the proxy server. The issue does not occur if you use Kerberos authentication.

In this scenario, you must log on to the computer as an administrator and then install the ActiveX controls without using the ActiveX Installer Service.

Descriptions of security and auditing related events that appear in Vista’s security log. Keep reading →

• Description of security events in Windows Vista and in Windows Server 2008
  Descriptions of security and auditing related events that appear in Vista’s security log.
  (tags: Security Event Log )
• Windows Vista Service Pack 1 stand-alone packages do not contain the updated Windows Vista Service Pack 1 Help files
  In a few situations, you’ll need to download the specific help file for your language.
  (tags: Help SP1 )

Keep reading →

Consider the following scenario:

• You configure the system to audit object access in Windows Server 2003, in Windows XP, or in Windows Vista.
• At a command prompt, you delete a file that has a long file name.

In this scenario, the Object Name field in audit event ID 560 incorrectly displays the name of the deleted file in an 8.3 file name format.

For example, audit event ID 560 may resemble the following:

Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: Date
Time: Time
User: UserName
Computer: ComputerName
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: Drive:\Path\Sample~1.EXE
New Handle ID: 92
Operation ID: {0,16979818}
Process ID: 1960
Primary User Name: UserName
Primary Domain: DomanName
Primary Logon ID: (0x0,0x19116)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses DELETE
ReadAttributes
Privileges –

When you delete a file that has a long file name in Windows Explorer, the Object Name field in audit event ID 560 displays the complete file name as expected.

You have a Windows Vista-based computer that supports High Precision Event Timer (HPET). When you restart the computer, the system time that is displayed on the clock lags behind the actual time. After you restart the computer several times, the system time lags behind the actual time even more.