> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Read Windows Event Log
- URL: https://www.filipkonopik.com/powershell-read-windows-event-log/
- Published: 2026-07-26T08:08:20.000Z
- Updated: 2026-08-06T05:33:15.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to check recent system events - for troubleshooting a crash, confirming an update installed, or general diagnostics? This one-liner pulls the most recent entries directly from the terminal.

Prerequisites:

- Privileges: None (for System and Application logs; Security log requires Administrator)
- Module: Built-in, no import needed

Quick Command:

```Powershell
Get-WinEvent -LogName System -MaxEvents 5
```

Example Output:

```PowerShell
ProviderName: Service Control Manager
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:58:45 AM           7040 Information      The start type of the Background Intelligent Transfer Servi...

   ProviderName: Microsoft-Windows-Kernel-General
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:58:27 AM             16 Information      The access history in hive \??\C:\Users\...

   ProviderName: Microsoft-Windows-WindowsUpdateClient
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:57:08 AM             19 Information      Installation Successful: Windows successfully installed the fol...
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- Get-WinEvent reads Windows event logs directly - it's the modern replacement for the older Get-EventLog cmdlet.
- \-LogName System specifies which log to read - common options include System, Application, and Security (the last one requires Administrator).
- \-MaxEvents 5 limits the output to the 5 most recent entries. Without this, Get-WinEvent returns the entire log, which can be tens of thousands of entries and take a long time to process.
- The output is grouped by ProviderName - the source component that generated each event (e.g. Windows Update Client, Kernel, Service Control Manager).