Tools
Cannot see any Event Viewer Logs in DameWare Remote Support (DRS) - Event Logs are blank - Windows KB5003637
When using DameWare Remote Support (DRS) to access remote host Event Viewer Logs, it shows nothing, the fields are empty and blank. Can't see Event View Logs - Windows KB5003637
First published date
9/24/2021 6:51 PM
Last published date
9/24/2021 6:51 PM
Overview
While using DameWare Remote Support (DRS), customers are unable to see Windows Event Viewer Logs on some machines but not on other machines.
In the June 8th Windows KB5003637 update due to security hardening changes relating to Event Tracing for Windows (ETW) for CVE-2021-31958, you may experience issues connecting to remote host Event Viewer Logs if both machines, the DameWare Client Installed computer and the remote host are not on Windows 10 with the KB5003637 update.
If the remote machine has Windows 10 with the KB5003637 update and your machine also has Windows 10 with the same update, you will be able to connect to and see the remote Event Viewer Logs.
In the June 8th Windows KB5003637 update due to security hardening changes relating to Event Tracing for Windows (ETW) for CVE-2021-31958, you may experience issues connecting to remote host Event Viewer Logs if both machines, the DameWare Client Installed computer and the remote host are not on Windows 10 with the KB5003637 update.
| Symptom | Workaround |
| After installing this or later updates, apps accessing event logs on remote devices might be unable to connect. This issue might occur if the local or remote has not yet installed updates released June 8, 2021 or later. Affected apps are using certain legacy Event Logging APIs. You might receive an error when attempting to connect, for example: Note Event Viewer and other apps using current non-legacy APIs to access event logs should not be affected.
| This is expected due to security hardening changes relating to Event Tracing for Windows (ETW) for CVE-2021-31958. This issue is resolved if the local and remote devices both have installed updates released June 8, 2021 or later. |
Examples:
If your DameWare Client installed machine, has Windows 7, it will be able to connect to other Windows 7 and Windows 10 Machines that do not have the KB installed. If your machine is Windows 10 without the KB and the remote machine is Windows 10 with the KB update, you will not be able to see the remote Event Logs.If the remote machine has Windows 10 with the KB5003637 update and your machine also has Windows 10 with the same update, you will be able to connect to and see the remote Event Viewer Logs.
Product section
Dameware Remote Support & Mini Remote Control
Cause
This is expected due to security hardening changes relating to Event Tracing for Windows (ETW) for CVE-2021-31958. This issue is resolved if the local and remote devices both have installed updates released June 8, 2021 or later.
Resolution
Identify Windows Versions and Updates
- Identify what Windows version is running and KB's installed on the computer you use to connect to remote machines
- Identify what Windows version is running and KB's installed on the remote machine
- Open PowerShell
- Paste the following into PowerShell and hit Enter
systeminfo /fo csv | ConvertFrom-Csv | select OS*, System*, Hotfix* | Format-List
Upgrade of Window Update
If your computer is on anything below Windows 10 KB5003637 and any of your remote machines are anything equal to or higher than Windows 10 KB5003637, upgrade your computer to Windows 10 and at least KB5003637.Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.