Audit event log: who reset VM on host

    General discussion

  • Hello!

    I try find user who reset VM on hyper-V host and set monitoring for this event id.

    Find in event log Microsoft-Windows-Hyper-V-Worker-admin -> event 18512

    This event tell that VM reset, but i understand who this user.

    p.s On screen user mark yellow color

    Tuesday, March 21, 2017 8:07 AM

All replies

  • That is the ID of the virtual machine. "Get-VM | select Name, ID" will show the same match.

    Hyper-V's built-in event system does not trap the user account that initiated a VM action.

    Eric Siron
    Altaro Hyper-V Blog
    I am an independent contributor, not an Altaro employee. I accept all responsibility for the content of my posts. You accept all responsibility for any actions that you take based on the content of my posts.

    Tuesday, March 21, 2017 12:52 PM
  • Eric, Thanks for information!
    Tuesday, March 21, 2017 1:04 PM