I was discussing this morning with a customer, here’s a useful reminder to this post if you need to deal with “legacy” .evt logs on Vista/Win2008.
wevtutil epl application.evt application.evtx /lf:true
Carlo
Quote of the day:That’s the secret to life… replace one worry with another…. – Charles M. Schulz