sorry i havn't been post much to this forum, in fact i havn't been posting much at all, it seems evertime i come here i find a whole bunch of things i need to research. you've been keeping me jumping hogfly! thanks!

i noticed noone mentioned dumpel.exe from the resource kit. it dumps the event logs in the format of your chosing within the time period you specify. i find this far easier than using the event viewer.