Get-WinEvent
Use Get-WinEvent to get events from event logs and event tracing log files on local and remote computers.
Documentation: Microsoft Learn — Get-WinEvent
Syntax
See the command anatomy
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-WinEvent [-LogName] <String[]> [-FilterHashtable] <Hashtable> [-MaxEvents <Int64>] [<CommonParameters>]- Stage 1Get-WinEvent
-LogName -FilterHashtable -MaxEvents
Try it
Browser simulation · fictional data; no changes to your computer.
Follow the objects
Run the command to inspect each stage.
Examples
Get-WinEvent -LogName System
Show reference output
Illustrative output · values vary by environment
Id LevelDisplayName ProviderName Message ---- ---------------- ----------------------- ------------------------------------ 7031 Error Service Control Manager A service terminated unexpectedly. 6005 Information EventLog The event log service started. 1000 Error Application Error An application fault was recorded. 1014 Warning DNS Client Events A name resolution request timed out.
Get-WinEvent -FilterHashtable @{LogName="System"; Level=2}
Show reference output
Illustrative output · values vary by environment
Id LevelDisplayName ProviderName Message ---- ---------------- ----------------------- ------------------------------------ 7031 Error Service Control Manager The Print Spooler service terminated unexpectedly... 7034 Error Service Control Manager The Windows Update service terminated unexpectedly...
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4625}
Show reference output
Illustrative output · values vary by environment
TimeCreated Id LevelDisplayName ProviderName ----------- -- ---------------- ------------ 10/14/2026 9:41 AM 4625 Information Microsoft-Windows-Security-Auditing 10/14/2026 9:38 AM 4625 Information Microsoft-Windows-Security-Auditing
Parameters
Parameter definitions:
-LogName-FilterHashtable-MaxEvents
Practical use and troubleshooting
Practical scenario: Use Get-WinEvent when you need to get events from event logs and event tracing log files on local and remote computers. Start with one identified target and inspect the returned values before extending the operation to a list. Keep the identity in your report so you can trace each result back to the object or path that produced it.
Common error and fix: No events found can mean the time window or event ID filter matches nothing. Test the log name and a wider query, then narrow the filter without treating an empty set as a successful health check. In an unattended script, capture this failure with its original error record and record which target failed. An empty result and an unsuccessful query must remain distinguishable in the final report.
See also: Get-Error. Get-WinEvent reads Windows event records; Get-Error inspects PowerShell error records. Choose the log containing the event rather than assuming console errors and Windows logs are identical. Read the linked command before substituting it; similar names do not imply identical inputs or output.
Put this command to work
Filter error events
Return complete System-log event records with LevelDisplayName Error.
The sandbox is visible now. Sign in with Google only when you run or check a task; commands and temporary files are discarded when you leave.
Run a command to inspect its result.
Inspect starting data
Supported syntax
Virtual files
Recap
Get-WinEvent Use Get-WinEvent to get events from event logs and event tracing log files on local and remote computers.
Next: Get-Counter