> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Use Event Viewer to Find Errors on Windows Server

> Find errors in Event Viewer on Windows Server: open eventvwr.msc, filter the System and Application logs for Critical and Error, or query them with Get-WinEvent.

To find errors on Windows Server, press **Windows+R**, run `eventvwr.msc`, open **Windows Logs > System** (then **Application**), click **Filter Current Log** and tick **Critical** and **Error**. Look at the events around the time the problem started. In PowerShell, `Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-1) }` lists the same errors from the last 24 hours.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 5 to 15 minutes | Windows Server 2019 / 2022 / 2025 | Administrator access (for the Security log) |

## Before you start

* Note roughly when the problem happened: a crash, a failed service, a restart you didn't expect. Event Viewer is easiest to use when you know the time.
* Sign in with RDP, or through the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) if RDP doesn't work.

## Which log should I check?

| Log | What it records |
| - | - |
| **Windows Logs > System** | Windows itself: drivers, services, restarts, disks, Windows Update |
| **Windows Logs > Application** | Programs: IIS, SQL Server, game servers, .NET crashes |
| **Windows Logs > Security** | Sign-ins, failed logins, account lockouts (needs administrator rights) |
| **Applications and Services Logs** | Detailed logs per component, for example **Microsoft > Windows > TerminalServices-...** for Remote Desktop |

Each event has a **Level**: **Critical** (1), **Error** (2), **Warning** (3) and **Information** (4). Start with Critical and Error.

## How to filter Event Viewer for errors

**1. Open Event Viewer**

Press **Windows+R**, type `eventvwr.msc` and press **Enter**. Or open **Control Panel > System and Security** and, under **Administrative Tools**, click **View event logs**.

**2. Choose a log**

In the left pane, expand **Windows Logs** and click **System**.

**3. Filter for errors**

In the **Actions** pane on the right, click **Filter Current Log**. Tick **Critical** and **Error** and click **OK**. Sort by **Date and Time** to find the events around your problem.

**4. Read the event**

Click an event. The **General** tab shows the message; note the **Source** and **Event ID**. Search for that source and ID together, for example "Kernel-Power 41".

**5. Repeat for Application**

Do the same for **Windows Logs > Application**.

## How to find errors with PowerShell

Errors and critical events in the System log from the last 24 hours:

```powershell theme={null}
Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-1) } |
  Select-Object TimeCreated, Id, ProviderName, Message
```

The 20 newest errors in the Application log:

```powershell theme={null}
Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=2 } -MaxEvents 20 |
  Format-Table TimeCreated, Id, ProviderName -AutoSize
```

All events with one ID, for example unexpected shutdowns:

```powershell theme={null}
Get-WinEvent -FilterHashtable @{ LogName='System'; Id=41,6008 } |
  Select-Object TimeCreated, Id, Message
```

If no events match, PowerShell shows `No events were found that match the specified selection criteria.` That is good news, not an error.

## Event IDs worth knowing

| Event ID | Log and source | Meaning |
| - | - | - |
| 41 | System, Kernel-Power | "The system has rebooted without cleanly shutting down first." Crash, hang or power loss. |
| 6008 | System, EventLog | "The previous system shutdown at … was unexpected." |
| 1074 | System, User32 | A planned restart or shutdown, with the process, user and reason. |
| 1001 | System, WER-SystemErrorReporting | "The computer has rebooted from a bugcheck." A blue screen, with the stop code. |
| 7045 | System, Service Control Manager | A new service was installed. Useful when a crash follows new software or a driver. |
| 19 | System, WindowsUpdateClient | An update installed successfully. |
| 4625 | Security | "An account failed to log on." Logon type 10 is Remote Desktop. |
| 4740 | Security | "A user account was locked out." |

Microsoft's rule of thumb: a normal restart shows 1074, then 13 and 6009. An unexpected one shows 41 and 6008, usually without a 1074 before it.

## How to check it worked

You see a short list of Critical and Error events with timestamps. If the list is empty for the time of the problem, widen the range or check **Warning** too.

## Frequently asked questions

### Are all red errors a problem?

No. Many servers log harmless errors every day. Focus on errors at the time of your problem and errors that repeat.

### How do I see who restarted the server?

Filter the System log for event ID `1074`. It names the process and the user that started the restart, and the reason.

### How do I see failed RDP logins?

Filter the Security log for `4625`. See [see failed login attempts on Windows Server](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md).

### Can I search for one application's errors?

Yes. In **Filter Current Log**, pick it under **Event sources**. In PowerShell, add `ProviderName='Name'` to the filter hashtable.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md)
>
> Read event 4625.

> [card] [Windows Server running slow](https://help.freakhosting.com/portals/other/how-to-fix-windows-server-running-slow.md)
>
> Find the bottleneck.

> [card] [Windows Server not booting](https://help.freakhosting.com/portals/other/how-to-fix-windows-server-not-booting.md)
>
> When Windows doesn't start.

> [card] [Use PowerShell](https://help.freakhosting.com/portals/other/how-to-use-powershell-on-windows-server.md)
>
> PowerShell basics.

***

> [!NOTE]
>
> **Checked against [Microsoft Learn: Get-WinEvent](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent), [Troubleshoot unexpected reboots using system event logs](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs), [Event 4625](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625) and [Event 4740](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740)** on 4 November 2026. Commands were not tested on a live Windows server for this page.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.