I was discussing this morning with a customer, here’s a useful reminder to this post if you need to deal with “legacy” .evt logs on Vista/Win2008.

      wevtutil epl application.evt application.evtx /lf:true

Carlo

Quote of the day:
That's the secret to life... replace one worry with another.... - Charles M. Schulz