Windows records almost everything that happens on your server in the event logs. Event Viewer is where you find out why the server restarted, why an app crashed or who tried to log in over RDP. Learning a few filters and event IDs saves hours of guessing.
Before you start
- An RDP session as an administrator (see connect with RDP).
Open Event Viewer
Press Win+R, type eventvwr.msc and press Enter, or go to Server Manager → Tools → Event Viewer.
The logs that matter
- Windows Logs → System: drivers, services, shutdowns and reboots.
- Windows Logs → Application: crashes and errors from programs, IIS, SQL Server.
- Windows Logs → Security: logons, failed logons and account changes.
- Applications and Services Logs → Microsoft → Windows → TerminalServices-*: RDP connections and sessions.
Levels go from Information to Warning, Error and Critical. Focus on Error and Critical first.
Filter a log
- Select a log, e.g. System.
- In the right pane click Filter Current Log.
- Choose a time range under Logged, tick Critical and Error, or type event IDs (comma-separated) in the ID box.
- Click OK. Double-click an event to read the details.
To reuse a filter, use Create Custom View instead; it appears under Custom Views.
Useful event IDs
| ID | Log | Meaning |
|---|---|---|
| 6005 / 6006 | System | Event log started / stopped (boot and clean shutdown) |
| 6008 | System | Previous shutdown was unexpected |
| 1074 | System | Who or what started a restart, e.g. Windows Update |
| 41 | System | Rebooted without a clean shutdown (Kernel-Power) |
| 7034 / 7031 | System | A service stopped unexpectedly |
| 1000 | Application | Application crash, with the faulting module |
| 4624 / 4625 | Security | Successful / failed logon (type 10 is RDP) |
| 4740 | Security | Account locked out |
Tip: Many 4625 events from unknown IPs mean bots are guessing passwords over RDP. Lock it down with secure RDP on Windows Server and an account lockout policy.
Query events with PowerShell
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074,6008} -MaxEvents 10 | Format-List TimeCreated, MessageMore in PowerShell essentials.
Keep logs from rolling over
Right-click a log, choose Properties and raise Maximum log size (for example 100 MB for Security) so older events are kept longer.
Troubleshooting
- Security log is empty: auditing is not enabled; see auditing policies.
- Too many events to read: filter by Error and a 24-hour window first.