How can I "Un-Edit" default view in Custom Views of the Event Editor

Hello all. Seems like I have managed to screw up the default "Administrative Events" in the Custom Views section of the Event Viewer. I filtered it for warnings, etc., intending to save as a new definition, but in fact managed to apply the filter to the default definition itself. Doh! Now, I can't unfilter or delete it - the options are greyed out in the editor. Anyone know how to reset that item to default?

Using build 1703. Must be a bug that permitted me to edit that view in the first place?

pepanee said:

Can you take a screen shot of the greyed out thing you're talking about?

Under Custom views of the Event Viewer: Right click Administrative Events => Properties => Edit Filter and you should get a read only Custom View Properties window. But somehow, in my case I inadvertently edited it before it became read only, and I can't see how to get back the default.


@spunk - Not clear how to do that. There's no "User Preferences" in the Win 10 Control Panel. Where is the "CommCell Console" ? But sure, I can make my own custom unfiltered view - which I did (see screen capture.) I'm just wondering how to reset the default. And why Win10 let me edit it in the first place.

pepanee said:

I'm assuming it's a custom setting that Microsoft has made that is un-editable.
.......

Ah, but you did edit it. That's the point. We just can't UN-edit it. In C:\ProgramData\Microsoft\Event Viewer\Views one finds an .xml file definition for each user-created custom view, but no definition for this default "custom view." So how did WIN 10 let us edit it? A small mystery. I've searched my drive for a string of text that I'd entered in the description field. Registry too. No luck. It must be encoded somewhere.

I don't have my Win10 machine handy to check right now, but I checked my Win7Pro C:\ProgramData\Microsoft\Event Viewer\Views folder and found nothing but an empty C:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode folder (no .xml files). I don't think I've ever customized the view, as I usually use NirSoft's MyEventViewer (much simpler and more flexible for my needs).

Could it be that the custom .xml file(s) you have are created only when you customize the view, & otherwise Windows uses its own default view? Given the ProgramData path, I'm guessing the folder would only contain data/settings generated by User usage. Perhaps you could check that by temporarily moving or renaming the existing .xml file(s) and seeing if the view reverts to default. (...might require a reboot but I'm guessing not)

pepanee said:

I've never created that custom thing; It was already there. .............

Gad, my apologies. I was so sure that when I first looked to edit that view, it had no check marks at all; IOW, that it gave ALL events. Now I see your check pattern is the same as mine, and so is your description. Could've sworn I'd changed mine, but guess not. Too many hours dealing with a crashed boot drive I guess.

Perhaps someone else could confirm that the "three checks" template is the default, but I apologize for even starting this thread.
@gdv - Yes, an XML file is created when you create a new custom event profile.