Practice Inspect error events

Inspect error events

Exercise 1 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Return event IDs and providers for Error events.

The task

A service incident needs a short event summary. Separate error events from informational startup messages.

Return event IDs and providers for Error events.

An event ID is interpreted together with its provider and log. The same numeric ID can mean different things for different providers.

Run the source by itself and inspect the sample objects. Add each filter separately, then check the final properties and order.

The browser uses a small fictional dataset. Real results depend on the host, module, account and target environment.

Choose an answer, then check your reasoning.

Worked solution

Reveal one approach

1PS> Get-WinEvent -LogName System | Where-Object LevelDisplayName -eq 'Error' | Select-Object Id, ProviderName

Write your pipeline below and run it against the fictional sample data, then check your result against the expected answer.

Your pipeline

Interactive simulation · fictional data