How do I open Event Viewer with Custom Views> Adminstrative Events?

Hi :),

I open Windows Event Viewer often (most days) to take a look for entries in the Windows 10 created Filter
Custom Views> ServerRoles> Administrative Events. (especially as my Win 10Pro (x64) is newly installed)What I wish to seek advice on is, how can I adjust my Desktop shortcut %windir%\system32\eventvwr.msc /s so that when I click on it Window Event Viewer will always open with Custom Views> ServerRoles> Administrative Events expanded (which I believe is a Windows filter). I did manage to work out how to open with "Windows Logs> Applications" but I am not able to use the same method with Administrative Events.

My clean install of Win 10 Pro (x64) Windows Event Viewer always opens with Event Viewer (Local) and I have to drill down the tree each time to view "Administrative Events"

I have searched the Web (without success) and also viewed eventvwr /? via cmd.exe but it is beyond my understanding in relation to what I wish to achieve.
I am hoping somebody can kindly advise me on what I need in my shortcut.

Many thanks

I would also like to customize an event viewer link.
Can a link open a custom view like DKO requested, and also attach to a remote server, not "local ."
Any ideas/answers/replies would be appreciated.
Thanks!

HOW TO CREATE A SHORTCUT ON YOUR DESKTOP TO CUSTOMIZE HOW EVENT VIEWER OPENS:

1. Create the view
2. Export the view
3. Create a batch file that opens Event Viewer the way you want it to.
4. Put a link to that batch file on your desktop.

===========
1. Create the view
- Open Event Viewer on your computer.
- (OPTIONAL: Connect to another computer)
- Select a log
- Click Create Custom View in the Actions pane.
- Configure the Filter how you want it. Click OK.
- Give it a name, do anything else you want in that dialog, and click OK.
===========
2. Export the view
- With your new view selected, click Export Custom View in the Actions pane.
- Name it (I make the file name the same as the view name).
- Save it where you want. (Keep in mind that your shortcut will always have to refer to this file, so you may want to keep it on your local hard drive, maybe in a subfolder or the root of my documents.)
===========
3. Create a batch file that opens Event Viewer the way you want it to.
- See the syntax of the Eventvwr command in this TechNet article: https://technet.microsoft.com/en-us/...(v=ws.11).aspx
.. .. If the link doesn't work, search TechNet.
.. .. .. .. "Work with Event Logs on a Remote Computer" or "cc766438(v=ws.11)" will find the exact article.
.. .. .. .. .. .. .. .. "cc766438" will find that article and related ones.
- Save the batch file where you want. (Same as in #2, above).
===========
4. Put a link to that batch file on your desktop.
===========
===========
EXAMPLE:
To check for reboots of my local computer, I look for the event log to be stopped and started.
Event ID
. . 6006= The Event log service was stopped.
. . 6005= The Event log service was started.

===========
Following the steps above:
===========
1. Create the view
Open Event Viewer
Choose System Log
Click Create Custom View
Filter the log by Source and Event ID's
- - - - - - Source: eventlog.
- - - - - - Event ID's 6005,6006 **
Click OK
Enter Reboots as the name and save it in Custom Views
===========
2. Export the view
Select Reboots
Click Export Custom View
Enter Reboots as the File name
Save it to Documents
===========
3. Create a batch file that opens Event Viewer the way you want it to.
- Create a new text file in Documents, changing the name to "Reboots.bat." Include the quotes so that ".txt" is not added to the filename.
- Paste this command into Reboots.bat: Eventvwr /v:"C:\Users\<username>\Documents\Reboots.xml"
- Save.
===========
4. Put a link to that batch file on your desktop.
- In Documents, right-click Reboots.bat
- Click Create Shortcut
- Rename the shortcut to Reboots.
- Cut and Paste it onto your Desktop
===========
** TIP for filtering Event Logs:
Separate event ID's by a comma. To exclude event ID's, put a minus sign in front of the ID #.

EXAMPLE:
Source: . . . . . . . . eventlog
Event ID's: . . . . . -6008,-6009,-6013.)
===========

Hi DoctorZ123IT,

Thanks to the detailed info which I am sure will greatly assist other user seeking a similar requirement. You solution looks very much like what I eventually found out after much trial and error around a year ago after my Original post (now 15 months ago) did not receive any suggestions.

Kind Regards,
DKO

Thx, DKO. And thanks for your post. It was the only one that is what i was looking for.