How to Collect Windows Event Logs Using Event Viewer, CMD and PowerShell
Windows Event Logs are an important source of information for IT administrators, system engineers, cybersecurity professionals, and digital forensic investigators. They help identify system errors, application failures, security-related activities, service problems, and other events that may affect the stability or security of a computer.
Knowing how to collect Windows Event Logs is a useful skill for troubleshooting Windows computers, investigating technical incidents, and maintaining IT security records.
In this guide, ITSolution4U explains how to collect Windows Event Logs using three built-in Windows tools: Event Viewer, Command Prompt, and PowerShell.
Whether you are a beginner learning Windows administration or an experienced IT professional managing business systems, these methods can help you collect and review event information without installing additional software.
What Are Windows Event Logs?
Windows Event Logs are records created by the Windows operating system and installed applications. Each event may contain information such as the event source, date and time, event ID, severity level, and a description of the activity.
Administrators can use these records to investigate errors, review configured security auditing events, and understand what happened on a Windows system.
Types of Windows Event Logs
1. Application Log
The Application log records events generated by applications and software components. It can help troubleshoot application crashes, warnings, and other software-related issues.
2. System Log
The System log contains events generated by Windows system components, drivers, and services. It is useful when investigating startup problems, service failures, and operating system errors.
3. Security Log
The Security log contains events generated by Windows security auditing. Depending on the audit policies configured on the computer, it may record successful or failed logons and other security-related activities.
4. Setup Log
The Setup log records events associated with Windows setup and related installation activities.
5. Forwarded Events
The Forwarded Events log can contain events collected from other computers through a configured Windows Event Forwarding environment.
Why Should You Collect Windows Event Logs?
Collecting event logs can help IT teams:
Troubleshoot Windows operating system and application errors.
Investigate unexpected restarts and service failures.
Review security auditing records.
Identify recurring warnings and errors.
Support authorized cybersecurity investigations.
Preserve event records for technical analysis.
Prepare supporting evidence for internal IT reviews.
Event logs should be interpreted in context. An error or warning does not automatically indicate a security incident, and the absence of an event does not prove that an activity never occurred.
Method 1: Collect Windows Event Logs Using Event Viewer
Event Viewer is a built-in Windows utility that provides a graphical interface for viewing and exporting event records.
Step 1: Open Event Viewer
Press Windows + R on your keyboard.
Type
eventvwr.msc.Press Enter.
Wait for the Event Viewer window to open.
You can also search for Event Viewer in the Windows Start menu.
Step 2: Select the Required Log
In the left navigation pane:
Expand Windows Logs.
Select System, Application, or Security.
Review the available events in the middle pane.
Select an event to view its details.
You can review the event level, source, Event ID, date and time, and description.
Step 3: Export the Event Log
To save a copy of the selected log:
Select the required log.
Right-click it or use the Actions panel.
Select Save All Events As….
Choose a destination folder.
Enter a descriptive filename, such as
System_Logs.evtx.Select the Windows Event Log (
.evtx) format.Click Save.
If Windows asks whether to include display information for another language, choose the option appropriate for the intended recipient.
Step 4: Verify the Exported Log
Open the folder where you saved the file.
Confirm that the
.evtxfile exists.Open Event Viewer.
Select Open Saved Log… from the Actions panel.
Browse to the exported file and open it.
Confirm that the saved events can be viewed.
Result: You have collected a copy of the selected Windows Event Log for troubleshooting or authorized analysis.
Method 2: Collect Windows Event Logs Using Command Prompt
Command Prompt provides another way to export Windows Event Logs using the built-in wevtutil utility.
Step 1: Open Command Prompt
Search for Command Prompt in the Start menu. Right-click it and select Run as administrator if elevated permissions are required.
Step 2: Create a Folder for the Logs
Run this command:
mkdir C:\EventLogsIf the folder already exists, you can continue to the next step.
Step 3: Export the System Log
wevtutil epl System C:\EventLogs\System_Logs.evtxStep 4: Export the Application Log
wevtutil epl Application C:\EventLogs\Application_Logs.evtxStep 5: Export the Security Log
wevtutil epl Security C:\EventLogs\Security_Logs.evtxAccess to the Security log may require an elevated account or specific permissions. If access is denied, contact your authorized system administrator.
Step 6: Check the Exported Files
Open C:\EventLogs in File Explorer and verify that the exported files are present.
These commands export copies of the logs. They do not intentionally clear the original logs.
Method 3: Collect Windows Event Logs Using PowerShell
PowerShell is useful for repeatable administration tasks, event filtering, and reporting.
Step 1: Open PowerShell
Search for Windows PowerShell in the Start menu. Select Run as administrator if required for the logs you need to collect.
Step 2: Create the Collection Folder
Run:
New-Item -Path "C:\EventLogs" -ItemType Directory -ForceStep 3: Export the Required Logs
Use the following commands to export the System and Application logs:
wevtutil epl System "C:\EventLogs\System_Logs.evtx"
To export the Security log:
wevtutil epl Security "C:\EventLogs\Security_Logs.evtx"Step 4: View Recent System Events
The following command displays the latest 100 System events:
Get-WinEvent -LogName System -MaxEvents 100 |
This is useful when you need a quick overview of recent system activity.
Step 5: Export Recent Events to CSV
For a spreadsheet-friendly report, run:
Get-WinEvent -LogName System -MaxEvents 100 |
You can open the resulting CSV file in Microsoft Excel or another compatible spreadsheet application.
Keep in mind that CSV is a report format. It does not preserve all the information and structure contained in a native .evtx file.
How to Collect Windows Events from the Last 24 Hours
When troubleshooting a recent problem, you may want to review events from a specific period.
Run this PowerShell command to display System events from the last 24 hours:
$StartTime = (Get-Date).AddHours(-24)
This command filters events by their recorded time and displays the matching results.
For a formal investigation, preserve the original event log as well as any filtered report. Filtering the results does not replace preserving the original records.
Best Practices for Windows Event Log Collection
Following good collection practices helps protect the reliability and confidentiality of event records.
1. Use authorized access: Collect logs only from computers and systems you are permitted to administer.
2. Preserve original files: Save the exported .evtx files before performing detailed analysis.
3. Record collection details: Document the computer name, collection date and time, time zone, collector, and reason for collection.
4. Protect sensitive information: Store logs in a restricted-access location because event records may contain usernames, computer names, IP addresses, or other sensitive details.
5. Avoid clearing logs: Do not clear the original event logs when your objective is to preserve records for troubleshooting or investigation.
6. Verify file integrity: Calculate a SHA-256 hash for the exported file and record the result. A matching hash on a later check supports the conclusion that the file has remained unchanged between the two checks.
For example:
Get-FileHash "C:\EventLogs\System_Logs.evtx" -Algorithm SHA2567. Follow retention requirements: Store and retain logs according to your organization's security, privacy, and incident-response policies.
8. Check the system time: Record the time zone and consider any clock differences when comparing events from multiple computers.
Frequently Asked Questions (FAQs)
1. Where are Windows Event Logs stored?
Windows Event Logs are commonly stored in:
C:\Windows\System32\winevt\Logs
The files in this directory are managed by Windows. For routine collection, use Event Viewer or supported command-line tools instead of manipulating the files directly.
2. Which file format should I use to save Windows Event Logs?
The .evtx format is generally the preferred choice when you want to preserve Windows Event Log records in their native format. CSV can be useful for reporting and spreadsheet analysis.
3. Can I collect Windows Event Logs without third-party software?
Yes. Event Viewer, Command Prompt with wevtutil, and PowerShell with Get-WinEvent are built-in options available on supported Windows systems.
4. Do I need administrator access to collect Windows Event Logs?
Not always. Access requirements depend on the specific log, Windows configuration, and account permissions. Security log collection commonly requires elevated or specifically granted permissions.
5. Does exporting an event log delete the original records?
No. The export procedures described in this guide save a copy of the selected log. They do not intentionally clear the original event log.
6. Can Windows Event Logs help with cybersecurity investigations?
Yes. Event logs can provide useful information about configured auditing events, system errors, application activity, and other recorded events. They should be correlated with other evidence before drawing conclusions.
7. How can I collect logs from multiple Windows computers?
For larger environments, administrators can use authorized PowerShell remoting, Windows Event Forwarding, or a centralized log-management platform. These approaches require appropriate permissions, connectivity, configuration, and security controls.
Conclusion
Windows Event Logs provide useful information for Windows administration, troubleshooting, and cybersecurity investigations.
You can collect them using Event Viewer for a graphical approach, Command Prompt for quick exports, or PowerShell for automation and reporting. For investigations, preserve the original .evtx files, document the collection process, and protect the records from unauthorized access or modification.
We hope this step-by-step guide helps you understand how to collect Windows Event Logs and apply these techniques in your IT environment.
Need Help with Windows Administration or Cybersecurity?
If you have any queries regarding Windows Event Logs, IT infrastructure, cybersecurity, or digital forensics, please let us know.
ITSolution4U
Website: https://www.itsolution4u.in
Contact: +91 9824974641
Email: info@itsolution4u.in