1. Opening Event Viewer

  • Use eventvwr.msc from the Run dialog or search for "Event Viewer" in the Start menu.

2. Filtering Events

  • Use the "Filter Current Log" option to narrow down events based on criteria like Event ID, Keywords, etc.

3. Creating Custom Views

  • Use "Create Custom View" to save specific filters for quick access.

4. Exporting Logs

  • Use the "Save All Events As" option to export logs in various formats (e.g., CSV, XML).

5. Clearing Logs

  • Use the "Clear Log" option to delete all events from a specific log.

6. Attaching Tasks to Events

  • Use the "Attach Task To This Event" option to perform specific actions when an event occurs.

7. Using Event Viewer with PowerShell

  • Leverage PowerShell cmdlets like Get-EventLog and Get-WinEvent to query and manage event logs.

8. Understanding Event Levels

  • Familiarize yourself with event levels (Information, Warning, Error, etc.) to prioritize investigations.

9. Understanding Event Sources

  • Identify the source of events to understand which application or component logged them.

10. Analyzing Event Details

  • Dive into the "Details" tab of an event to understand its specifics and troubleshoot effectively.

Event IDs in Microsoft Event Viewer

1. Event ID 4624: Successful Logon

  • Indicates a user successfully logged on to a computer.

2. Event ID 4625: Logon Failure

  • Indicates a failed logon attempt.

3. Event ID 4634: Logoff

  • Indicates a user logoff.

4. Event ID 4648: Explicit Credential Logon

  • Indicates a logon using explicit credentials.

5. Event ID 4663: File/Directory Access

  • Indicates an attempt to access a file or directory.

6. Event ID 4672: Special Privileges Assigned

  • Indicates special privileges assigned to a new logon.

7. Event ID 4688: Process Start

  • Indicates a new process creation.

8. Event ID 4689: Process End

  • Indicates a process termination.

9. Event ID 4698: Scheduled Task Created

  • Indicates a scheduled task was created.

10. Event ID 4700: Scheduled Task Enabled

  • Indicates a scheduled task was enabled.

11. Event ID 4719: System Audit Policy Change

  • Indicates a change in audit policy.

12. Event ID 4720: User Account Created

  • Indicates a user account was created.

13. Event ID 4722: User Account Enabled

  • Indicates a user account was enabled.

14. Event ID 4725: User Account Disabled

  • Indicates a user account was disabled.

15. Event ID 4738: User Account Changed

  • Indicates a user account was changed.

16. Event ID 4740: User Account Locked Out

  • Indicates a user account was locked out.

17. Event ID 4776: Credential Validation

  • Indicates a domain controller attempted to validate credentials.

18. Event ID 4798: User Account Query

  • Indicates a query was issued for a user account.

19. Event ID 4904: Security Auditing Setting Modification

  • Indicates an attempt to modify the per-user auditing settings.

20. Event ID 4946: Windows Firewall Rule Added

  • Indicates a new Windows Firewall rule was added.

Example PowerShell Commands

Query Specific Event ID

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} -MaxEvents 10

Query Events within a Date Range

Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime='MM/DD/YYYY 00:00:00'; EndTime='MM/DD/YYYY 23:59:59'}

Query Events from a Specific Log Source

Get-WinEvent -FilterHashtable @{LogName='Security'; ProviderName='Microsoft-Windows-Security-Auditing'}

Last updated