Windows Event Viewer

Event Viewer is the built-in log management tool in Windows Server. It records system errors, application crashes, security audits, and service events. Knowing how to read it is essential for diagnosing almost any Windows Server issue.

Open Event Viewer

Win + R → eventvwr.msc → Enter

Or via PowerShell:

eventvwr

Or from Server Manager → Tools → Event Viewer.

Log categories

Event levels

Common Event IDs

System

Security

Application

Filter events (most useful feature)

Instead of scrolling through thousands of entries, filter by what you need:

1. Right-click a log → Filter Current Log
2. Set:
   • Event level: Error, Critical
   • Event ID: e.g. 4625 for failed logins
   • Logged: Last 24 hours, Last 7 days
   • Event source: e.g. Application Error

PowerShell: faster log queries

PowerShell is much faster for searching large logs:

# Last 20 System errors
Get-EventLog -LogName System -EntryType Error -Newest 20 |
  Select-Object TimeGenerated, EventID, Source, Message |
  Format-Table -AutoSize

# All Critical events from last 24 hours
Get-WinEvent -FilterHashtable @{
  LogName   = 'System'
  Level     = 1  # Critical
  StartTime = (Get-Date).AddHours(-24)
}

# Find failed logins (Security log)
Get-WinEvent -FilterHashtable @{
  LogName = 'Security'
  Id      = 4625
  StartTime = (Get-Date).AddDays(-7)
} | Select-Object TimeCreated, Message | Format-List

# Find who rebooted the server
Get-EventLog -LogName System -Source "USER32" -EventID 1074 -Newest 10

# Find service crashes
Get-EventLog -LogName System -EventID 7034 -Newest 20 |
  Select-Object TimeGenerated, Message

Diagnose a server crash (unexpected reboot)

1. Open Windows Logs → System
2. Filter for Critical events
3. Look for Event ID 41: "The system has rebooted without cleanly shutting down"
4. Note the timestamp and look at events just before it

Common causes:

• BugCheck code in Event 41: BSOD, note the stop code, then check minidump
• Event 1001 (BugCheck): confirms BSOD, shows the stop code
• Driver-related errors minutes before crash: hardware driver issue

Check minidump files:

Get-ChildItem C:\Windows\Minidump\ | Sort-Object LastWriteTime -Descending | Select-Object -First 5

Diagnose a service that won't start

1. Open Windows Logs → System
2. Filter by Source: Service Control Manager
3. Look for Event IDs 7000 (failed to start) or 7034 (unexpected termination)
4. The message usually includes the error code

Cross-reference with Application log for the service's own error messages.

Find brute force / unauthorized access attempts

# Count failed logins per source IP
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} |
  ForEach-Object {
    $_.Properties[19].Value  # Source IP
  } |
  Group-Object | Sort-Object Count -Descending | Select-Object -First 20

If you see many failures from the same IP → block it in Windows Firewall:

New-NetFirewallRule -DisplayName "Block brute force IP" `
  -Direction Inbound -RemoteAddress "1.2.3.4" -Action Block

Export logs for analysis

# Export to CSV
Get-EventLog -LogName Application -Newest 1000 |
  Export-Csv C:\Logs\app-events.csv -NoTypeInformation

# Export to EVTX (native Windows format)
wevtutil epl System C:\Logs\system-export.evtx

# Export filtered events
wevtutil qe System /q:"*[System[Level<=2]]" /f:text > C:\Logs\system-errors.txt

Create a custom view (save your filters)

1. In Event Viewer, right-click Custom Views → Create Custom View
2. Set your filter (e.g., all errors from System + Application)
3. Give it a name like "All Errors"
4. It appears in the sidebar, click to view anytime

Set up email alerts for critical events

Use Windows Task Scheduler to send an email when a specific event occurs:

1. In Event Viewer, find the event you want to alert on
2. Right-click it → Attach Task To This Event
3. Choose Send an e-mail action
4. Configure SMTP settings

Or via PowerShell with a scheduled task triggered on event ID:

$trigger = New-ScheduledTaskTrigger -AtStartup
$action = New-ScheduledTaskAction -Execute "powershell.exe" `
  -Argument "-File C:\Scripts\alert.ps1"
Register-ScheduledTask -TaskName "CriticalEventAlert" -Trigger $trigger -Action $action