How to Open Event Viewer in Windows 10 and Windows 11

Overview

What Is Event Viewer in Windows 10 and 11?

Windows Event Viewer (also known as the Event Log) is a built-in system utility that records all significant activity on your PC — from application errors and security audits to system warnings and informational messages. It is one of the most powerful diagnostic tools available in Windows and is present in every version from Windows XP through Windows 11.

Understanding how to open and read the Event Viewer helps system administrators, IT professionals, and home users alike to troubleshoot crashes, track login attempts, identify failing hardware, and monitor service behavior.

ℹ️

Good to Know The executable for Event Viewer is eventvwr.msc. This file is located at C:\Windows\System32\eventvwr.msc and can be launched by any of the methods described in this guide.

Key Log Categories

Log Category	What It Records	Common Use Case
Application	Events from installed applications and programs	App crashes, software errors
Security	Login attempts, policy changes, privilege use	Security auditing, intrusion detection
System	Events from Windows OS and drivers	Driver failures, service stops
Setup	Installation and update events	Windows Update issues
Forwarded Events	Events collected from remote computers	Centralized enterprise logging

Method 1

How to Open Event Viewer via the Run Dialog

The fastest and most universal method for both Windows 10 and Windows 11 is using the Run dialog box. This works regardless of your taskbar layout or Start menu configuration.

Run Dialog — eventvwr.msc

Win 10 + Win 11

Press Win + R on your keyboard to open the Run dialog box.
Type eventvwr.msc in the Open field.
Press Enter or click OK.
The Event Viewer window will open immediately.

✅

Pro Tip You can also type simply eventvwr (without the .msc extension) and Windows will recognize the command just fine.

Method 2

Open Event Viewer from the Windows Start Menu Search

Both Windows 10 and Windows 11 have a built-in search feature in the taskbar that lets you find system tools instantly by name.

Start Menu / Taskbar Search

Win 10 + Win 11

Click the Search icon on the taskbar or press the Windows key.
Type Event Viewer in the search box.
The Event Viewer app will appear as the top result under "Best match."
Click on it — or press Enter — to launch it. To open it as an Administrator, right-click the result and choose Run as administrator.

💡

Windows 11 Note In Windows 11, the Search bar is separate from the Start button. Click the magnifying glass icon on the taskbar to open Search, then type "Event Viewer."

Method 3

Launch Event Viewer from the WinX Power User Menu

The Power User Menu (also called the WinX menu) is a hidden shortcut menu that provides quick access to advanced system tools. It is available in both Windows 10 and Windows 11.

Right-click the Start Button

Win 10 + Win 11

Right-click the Start button in the lower-left corner (Windows 10) or center of the taskbar (Windows 11).
A context menu will appear with advanced system shortcuts.
Click Event Viewer from the list.

Alternatively, you can press Win + X on your keyboard to open the same menu without using the mouse — then press V to select Event Viewer directly.

Method 4

Open Event Viewer Using Command Prompt (CMD)

Advanced users and system administrators often prefer to launch tools from the command line. This method is especially useful when running scripts or when the graphical shell is unavailable.

Command Prompt

Win 10 + Win 11

Press Win + S and type cmd, then press Enter to open Command Prompt (or right-click for "Run as administrator").
In the Command Prompt window, type the following command and press Enter:

Command Prompteventvwr.msc

Event Viewer will open in a separate window immediately.

⚠️

Administrator Access To view Security logs such as login audits, you must launch CMD as Administrator. Right-click Command Prompt and select "Run as administrator" before entering the command.

Method 5

Open Event Viewer via PowerShell in Windows 10 and 11

PowerShell provides both a GUI-based way to open Event Viewer and powerful cmdlets to query event logs directly from the terminal — without ever opening the graphical interface.

PowerShell — GUI & Command Line

Win 10 + Win 11

Open Event Viewer GUI

PowerShelleventvwr.msc

Query Logs Directly in PowerShell

To retrieve the last 20 System log errors without opening the GUI:

PowerShell — Get-EventLogGet-EventLog -LogName System -EntryType Error -Newest 20

For Windows 11 and modern PowerShell, the preferred cmdlet is Get-WinEvent:

PowerShell — Get-WinEventGet-WinEvent -LogName System -MaxEvents 20 | Where-Object { $_.LevelDisplayName -eq "Error" }

📘

Power User Tip Get-WinEvent is significantly faster than Get-EventLog for large logs and supports filtering by time range, event ID, and provider name. It is the recommended cmdlet on Windows 10 v1709+ and all versions of Windows 11.

Method 6

Find Event Viewer Through the Control Panel

The Control Panel route is a slightly longer path, but useful if you are already navigating system settings or prefer the classic Windows interface approach.

Control Panel → Administrative Tools

Win 10 + Win 11

Open the Start menu and search for Control Panel, then open it.
In Control Panel, set the view to Large icons or Small icons (not Category).
Click Windows Tools (Windows 11) or Administrative Tools (Windows 10).
In the folder that opens, double-click Event Viewer.

🗂️

Windows 11 Change Microsoft renamed Administrative Tools to Windows Tools in Windows 11. The folder is located at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Tools and contains all legacy admin utilities including Event Viewer.

Method 7

Access Event Viewer via Computer Management Console

Event Viewer is also embedded as a snap-in within the Computer Management console — a unified Microsoft Management Console (MMC) that groups several administrative tools in one place.

Computer Management (compmgmt.msc)

Win 10 + Win 11

Press Win + R to open the Run dialog.
Type compmgmt.msc and press Enter.
In the left panel of Computer Management, expand System Tools.
Click on Event Viewer to expand the log tree and start browsing events.

This approach is preferred by IT professionals who need to manage Event Viewer alongside Disk Management, Device Manager, and Services in a single window — especially when working remotely on another machine.

Comparing All Methods

✦ Fastest Methods

Win + R → eventvwr.msc (fastest overall)
Win + X → Event Viewer (no typing required)
Taskbar search (easiest for beginners)
PowerShell for automation & scripting

✦ Slower Methods

Control Panel route (multiple clicks)
Computer Management (extra navigation)
File Explorer path (rare use)

FAQ

Frequently Asked Questions About Windows Event Viewer

Below are the most common questions users have about opening and using the Event Log in Windows 10 and Windows 11.

Q Why does Event Viewer require administrator privileges for some logs? ▼

The Security log is restricted to administrators by default because it contains sensitive information such as user login attempts, privilege escalations, and policy changes. Standard user accounts can view Application and System logs, but accessing Security logs requires an elevated session. Right-click Event Viewer and choose Run as administrator to get full access.

Q What is the difference between Error, Warning, and Information events? ▼

Windows classifies events into five levels: Information (routine activity), Warning (a potential issue that did not cause a failure), Error (a significant problem that caused a loss of functionality), Critical (a failure requiring immediate attention), and Audit Success / Failure (security-related events in the Security log). Filtering by "Error" or "Critical" is the best starting point for diagnosing system issues.

Q Is Event Viewer the same in Windows 10 and Windows 11? ▼

Functionally, yes. The Event Viewer application (eventvwr.msc) is identical in both operating systems. The only difference is the route through Control Panel — Windows 11 renamed Administrative Tools to Windows Tools. All keyboard shortcuts and command-line methods work on both versions without any modification.

Q How do I filter events by a specific Event ID in Event Viewer? ▼

In Event Viewer, select the log you want to filter (e.g., System), then click Filter Current Log… in the right-hand Actions panel. In the dialog, enter the Event ID number (for example, 41 for an unexpected shutdown, or 7034 for a service crash). Click OK to show only events matching that ID. You can also combine multiple IDs separated by commas.

Q Can I open Event Viewer for a remote computer? ▼

Yes. In Event Viewer, right-click Event Viewer (Local) in the left panel and select Connect to Another Computer… Enter the hostname or IP address of the remote machine. You must have administrator credentials on the remote computer and ensure that the Windows Firewall allows remote event log management (TCP port 135 and the Remote Event Log Management firewall rules must be enabled on the target machine).

Q How do I export Event Viewer logs to a file? ▼

Right-click any log in Event Viewer and choose Save All Events As… You can export to .evtx (native Windows Event Log format), .xml, .txt, or .csv. The .evtx format is recommended if you need to analyze the log on another Windows machine. For sharing with non-Windows tools or Excel, export as CSV.

🏁 Summary

Windows Event Viewer is a critical diagnostic tool available on every version of Windows 10 and Windows 11. The fastest way to open it is pressing Win + R and typing eventvwr.msc. For everyday use, the Start menu search or the WinX menu (Win + X) are the most convenient options. Power users and system administrators can leverage PowerShell's Get-WinEvent cmdlet to query logs directly from the terminal without opening the GUI at all. Whichever method you choose, the Event Log remains your first stop for diagnosing errors, crashes, and security events on your Windows PC.