Windows 10: How do I open Event Viewer with Custom Views> Adminstrative Events? Solved

  1. Posts : 6
    Window 10 Pro (x64)
       29 Aug 2015 #1

    How do I open Event Viewer with Custom Views> Adminstrative Events?

    Hi ,

    I open Windows Event Viewer often (most days) to take a look for entries in the Windows 10 created Filter
    Custom Views> ServerRoles> Administrative Events. (especially as my Win 10Pro (x64) is newly installed)What I wish to seek advice on is, how can I adjust my Desktop shortcut %windir%\system32\eventvwr.msc /s so that when I click on it Window Event Viewer will always open with Custom Views> ServerRoles> Administrative Events expanded (which I believe is a Windows filter). I did manage to work out how to open with "Windows Logs> Applications" but I am not able to use the same method with Administrative Events.

    My clean install of Win 10 Pro (x64) Windows Event Viewer always opens with Event Viewer (Local) and I have to drill down the tree each time to view "Administrative Events"

    I have searched the Web (without success) and also viewed eventvwr /? via cmd.exe but it is beyond my understanding in relation to what I wish to achieve.
    I am hoping somebody can kindly advise me on what I need in my shortcut.

    Many thanks
      My System SpecsSystem Spec

  2.    18 Nov 2016 #2

    Link to open "custom view > xxx" on a REMOTE COMPUTER

    I would also like to customize an event viewer link.
    Can a link open a custom view like DKO requested, and also attach to a remote server, not "local ."
    Any ideas/answers/replies would be appreciated.
      My System SpecsSystem Spec

  3.    18 Nov 2016 #3



    1. Create the view
    2. Export the view
    3. Create a batch file that opens Event Viewer the way you want it to.
    4. Put a link to that batch file on your desktop.

    1. Create the view
    - Open Event Viewer on your computer.
    - (OPTIONAL: Connect to another computer)
    - Select a log
    - Click Create Custom View in the Actions pane.
    - Configure the Filter how you want it. Click OK.
    - Give it a name, do anything else you want in that dialog, and click OK.
    2. Export the view
    - With your new view selected, click Export Custom View in the Actions pane.
    - Name it (I make the file name the same as the view name).
    - Save it where you want. (Keep in mind that your shortcut will always have to refer to this file, so you may want to keep it on your local hard drive, maybe in a subfolder or the root of my documents.)
    3. Create a batch file that opens Event Viewer the way you want it to.
    - See the syntax of the Eventvwr command in this TechNet article:
    .. .. If the link doesn't work, search TechNet.
    .. .. .. .. "Work with Event Logs on a Remote Computer" or "cc766438(v=ws.11)" will find the exact article.
    .. .. .. .. .. .. .. .. "cc766438" will find that article and related ones.
    - Save the batch file where you want. (Same as in #2, above).
    4. Put a link to that batch file on your desktop.
    To check for reboots of my local computer, I look for the event log to be stopped and started.
    Event ID
    . . 6006= The Event log service was stopped.
    . . 6005= The Event log service was started.

    Following the steps above:
    1. Create the view
    Open Event Viewer
    Choose System Log
    Click Create Custom View
    Filter the log by Source and Event ID's
    - - - - - - Source: eventlog.
    - - - - - - Event ID's 6005,6006 **
    Click OK
    Enter Reboots as the name and save it in Custom Views
    2. Export the view
    Select Reboots
    Click Export Custom View
    Enter Reboots as the File name
    Save it to Documents
    3. Create a batch file that opens Event Viewer the way you want it to.
    - Create a new text file in Documents, changing the name to "Reboots.bat." Include the quotes so that ".txt" is not added to the filename.
    - Paste this command into Reboots.bat: Eventvwr /v:"C:\Users\<username>\Documents\Reboots.xml"
    - Save.
    4. Put a link to that batch file on your desktop.
    - In Documents, right-click Reboots.bat
    - Click Create Shortcut
    - Rename the shortcut to Reboots.
    - Cut and Paste it onto your Desktop
    ** TIP for filtering Event Logs:
    Separate event ID's by a comma. To exclude event ID's, put a minus sign in front of the ID #.

    Source: . . . . . . . . eventlog
    Event ID's: . . . . . -6008,-6009,-6013.)
      My System SpecsSystem Spec

  4. Posts : 6
    Window 10 Pro (x64)
       19 Nov 2016 #4

    Hi DoctorZ123IT,

    Thanks to the detailed info which I am sure will greatly assist other user seeking a similar requirement. You solution looks very much like what I eventually found out after much trial and error around a year ago after my Original post (now 15 months ago) did not receive any suggestions.

    Kind Regards,
      My System SpecsSystem Spec

  5.    19 Nov 2016 #5

    Thx, DKO. And thanks for your post. It was the only one that is what i was looking for.
      My System SpecsSystem Spec


Related Threads
Performance & Maintenance Event Viewer - Clear All Event Logs in Windows in Tutorials
How to Clear All Event Logs in Event Viewer in Windows Event Viewer is a tool that displays detailed information as event logs about significant events on your PC. Event logs are special files that record significant events on your PC, such as...
I would like, if it's possible, to stop a certain event from getting written to the event log. I know the source and the event id number. I've tried the option 'Filter current log . The problem is that when I get out of the Event Log and back in...
Weird event viewer errors in Performance & Maintenance
Hello, Event Viewer is showing the following errors: The User Data Storage_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service. The User...
Worried about event viewer errors in Performance & Maintenance
hi guys managed to install windows 10 and everything seems to be working great. I looked in event viewer and I'm getting loads of errors, the same over and over. one is that keeps coming up is kernel-power event id 137 The system...
Clearing event viewer entries in General Support
How can I construct a .bat file to clear entries in the event viewer. Thanks
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:50.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App

Windows 10 Forums