Skip to main content
To find errors on Windows Server, press Windows+R, run eventvwr.msc, open Windows Logs > System (then Application), click Filter Current Log and tick Critical and Error. Look at the events around the time the problem started. In PowerShell, Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-1) } lists the same errors from the last 24 hours.

​
Before you start

  • Note roughly when the problem happened: a crash, a failed service, a restart you didn’t expect. Event Viewer is easiest to use when you know the time.
  • Sign in with RDP, or through the VNC console if RDP doesn’t work.

​
Which log should I check?

Each event has a Level: Critical (1), Error (2), Warning (3) and Information (4). Start with Critical and Error.

​
How to filter Event Viewer for errors

1

Open Event Viewer

Press Windows+R, type eventvwr.msc and press Enter. Or open Control Panel > System and Security and, under Administrative Tools, click View event logs.
2

Choose a log

In the left pane, expand Windows Logs and click System.
3

Filter for errors

In the Actions pane on the right, click Filter Current Log. Tick Critical and Error and click OK. Sort by Date and Time to find the events around your problem.
4

Read the event

Click an event. The General tab shows the message; note the Source and Event ID. Search for that source and ID together, for example “Kernel-Power 41”.
5

Repeat for Application

Do the same for Windows Logs > Application.

​
How to find errors with PowerShell

Errors and critical events in the System log from the last 24 hours:
The 20 newest errors in the Application log:
All events with one ID, for example unexpected shutdowns:
If no events match, PowerShell shows No events were found that match the specified selection criteria. That is good news, not an error.

​
Event IDs worth knowing

Microsoft’s rule of thumb: a normal restart shows 1074, then 13 and 6009. An unexpected one shows 41 and 6008, usually without a 1074 before it.

​
How to check it worked

You see a short list of Critical and Error events with timestamps. If the list is empty for the time of the problem, widen the range or check Warning too.

​
Frequently asked questions

​
Are all red errors a problem?

No. Many servers log harmless errors every day. Focus on errors at the time of your problem and errors that repeat.

​
How do I see who restarted the server?

Filter the System log for event ID 1074. It names the process and the user that started the restart, and the reason.

​
How do I see failed RDP logins?

Filter the Security log for 4625. See see failed login attempts on Windows Server.

​
Can I search for one application’s errors?

Yes. In Filter Current Log, pick it under Event sources. In PowerShell, add ProviderName='Name' to the filter hashtable.

VPS and dedicated server guides

Every guide in this section.

Failed login attempts

Read event 4625.

Windows Server running slow

Find the bottleneck.

Windows Server not booting

When Windows doesn’t start.

Use PowerShell

PowerShell basics.
Checked against Microsoft Learn: Get-WinEvent, Troubleshoot unexpected reboots using system event logs, Event 4625 and Event 4740 on 4 November 2026. Commands were not tested on a live Windows server for this page.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026