Can individual events in Event Viewer be deleted/recovered?


  1. Frank15
    Posts : 163
    Windows 10
       New #1

    Can individual events in Event Viewer be deleted/recovered?


    I learnt how to check Event Viewer logs to detect my kids using the computer outside of their alloted times.

    Now I'm thinking: what if they're deleting individual events? (I know they're not deleting whole logs as that's easy to detect), they know how to google for these easy hacks, that's my concern.

    How can I know if they've deleted an event? Could I recover it?

    The events I'm interested in are these:
    4624 sign in LogonType 7
    4625 unsuccessful sign in
    4634 sign out LogonType 2
    4800 locked
    4801 unlocked
    SYSTEM:
    6005 started
    6006 shut down
    6008 dirty/improper shutdown (seems to be the next start after a dirty shutdown and maybe preceeded by a gap of time, to be confirmed) shows message when the dirty took place.

    Any help much appreciated
      My Computer
    Quote Quote

  3. Eagle51
    Posts : 1,471
    Win10 Home x64 - 1809
       New #2

    Hey antonio3535,
    No you can't delete individual events using the Event Viewer GUI.
      My Computers
    Quote Quote

 

  Related Discussions
The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step: Fixing DistributedCOM error 10016 Failing that (any other ideas folks on how to...
Hi. I'm running 1903. For some years I have used a simple program called PC On/Off Time to monitor when my computer has been booted up, put to sleep and shut down. It isn't working correctly anymore after recently recovering my computer which...
how do I reset the custom view ''administrative events'', which is the first class of event that windows create ? i do not want to erase the other logs, only this one
I'm using Event Viewer in Windows 10 to control my kids screen time. One of my kids (14yo) is a bit too tech savvy so I wonder if he may have googled for a way to delete entries (such as 4634 sign out LogonType 2 just to give an example). I guess...
Hi :), I open Windows Event Viewer often (most days) to take a look for entries in the Windows 10 created Filter Custom Views> ServerRoles> Administrative Events. (especially as my Win 10Pro (x64) is newly installed)What I wish to seek advice on...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 14:47.
Find Us




Windows 10 Forums