Can individual events in Event Viewer be deleted/recovered?  

  1. Posts : 163
    Windows 10

    Can individual events in Event Viewer be deleted/recovered?

    I learnt how to check Event Viewer logs to detect my kids using the computer outside of their alloted times.

    Now I'm thinking: what if they're deleting individual events? (I know they're not deleting whole logs as that's easy to detect), they know how to google for these easy hacks, that's my concern.

    How can I know if they've deleted an event? Could I recover it?

    The events I'm interested in are these:
    4624 sign in LogonType 7
    4625 unsuccessful sign in
    4634 sign out LogonType 2
    4800 locked
    4801 unlocked
    6005 started
    6006 shut down
    6008 dirty/improper shutdown (seems to be the next start after a dirty shutdown and maybe preceeded by a gap of time, to be confirmed) shows message when the dirty took place.

    Any help much appreciated
      My Computer

  2. Posts : 1,471
    Win10 Home x64 - 1809

    Hey antonio3535,
    No you can't delete individual events using the Event Viewer GUI.
      My Computers


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 04:46.
Find Us

Windows 10 Forums