ELDump ELDump is a tool to dump the contents of a NT event log as text. It is very much like the tool DumpEL from the NT Resource Kit, but ELDump is more versatile and sometimes quite a lot faster. Most important ELDump can: Dump from active event logs or from saved event logs with full message texts. Filter on all the same fields as the Event Viewer. Dump only the message strings instead of the full message texts. This is a lot faster and also makes it easier to parse the messages with other programs. Look for the message texts on an other server. This means you get message text even if all the applications and drivers that has logged messages are not installed on the machine where you are running ELDump. Dump several logs from several servers with one invocation of the ELDump command. Easily seach and dump logs saved with the ELSavClr tool. ELSavClr ELSavClr is a tool to periodically save and then clear NT Event Logs. You should execute ELSavClr once each night with the NT scheduler. It will then periodically save the logs to a directory and then clear the logs. You can use the NT Event Viewer, ELDump or other event log tools to later read the saved logs. Version 0.13 or later of ELDump is specially useful because it knows how to read all saved logs in combination with the current active log. ELSave ELSave is a tool to save and/or clear a NT event log. Essential NetTools A pack of many tools in one application. No more DOS command-line operations: forget about nbtstat.exe, netstat.exe, and nat.exe with multiple switches: the program does everything for you. Adjustable performance: NetBIOS scanning has never been faster! A Class C network can be scanned in less then a minute. Report generation in HTML format. Visual and sound alerts. NetViewX NetViewX is a tool to list the servers in a domain or workgroup. It is a bit like the NT "net view /domain" command, but it allows you to list only servers with specific services, and it uses a list format that is easily parsable. SecExplorer Security Explorer is a powerful and intuitive utility to search for and modify Windows NT security on NTFS drives, the Registry, and Shares. Search across subdirectories for permissions. Grant, revoke, and clone permissions across subdirectories without affecting any other user's permissions. SrvBoot The SrvBoot command will print the times where one or more NT servers were booted. SrvBoot reads the System Event Log to get this information, so if the server was not booted since the System Event Log was last cleared or wrapped, then nothing is printed. UserSes The UserSes command will list logon/logoff sessions for one or more users. UserSes reads the Security Event Logs on all domain controllers to get the session information. For this to work you must have enabled audit of Logon and Logoff at the Domain Controller (you do that in the User Manager for Domains at the Policies, Audit menu). Also, when running the UserSes command you must have the SE_SECURITY_NAME User Right (you will normally have this User Right if you run as Administrator). WsSes The WsSes command will list logon/logoff sessions from one or more workstations. WsSes reads the Security Event Logs on all domain controllers to get the session information. For this to work you must have enabled audit of Logon and Logoff at the Domain Controller (you do that in the User Manager for Domains at the Policies, Audit menu). Also, when running the WsSes command you must have the SE_SECURITY_NAME User Right (you will normally have this User Right if you run as Administrator).