PSS ID Number: 300495
Article Last Modified on 11/18/2003
The information in this article applies to:
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
This article was previously published under Q300495
SYMPTOMS
When you use an account that is a member of the Backup Operators group and you back up a partition that Windows 2000 resides on, Microsoft Windows NT Backup does not capture the Windows NT Event Viewer (.evt) files.
CAUSE
This behavior can occur if Backup Operators do not have sufficient permissions to back up or restore .evt files.
RESOLUTION
To work around this behavior, members of the local or domain Administrators group can back up and restore Event Viewer (.evt) files.
STATUS
This behavior is by design.
MORE INFORMATION
By design, .evt files maintain a record of recent events. The restore process replaces the event log files (.evt) and any event log information that is captured in Event Viewer is overwritten by the .evt files from the backups.
Windows NT Backup captures .evt files for Administrators so that Administrators can back up the necessary files to view older events. Administrators must use caution when they restore an older event file to a computer because any new events are overwritten in the process.
Keywords: kbBackup kbprb w2000ntbackup KB300495
Technology: kbwin2000AdvServ kbwin2000AdvServSearch kbwin2000Pro kbwin2000ProSearch kbwin2000Search kbwin2000Serv kbwin2000ServSearch kbWinAdvServSearch
