PowerShell: Read Windows Event Log

Need to check recent system events - for troubleshooting a crash, confirming an update installed, or general diagnostics? This one-liner pulls the most recent entries directly from the terminal.

Prerequisites:

• Privileges: None (for System and Application logs; Security log requires Administrator)
• Module: Built-in, no import needed

Quick Command:

Get-WinEvent -LogName System -MaxEvents 5

Example Output:

ProviderName: Service Control Manager
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:58:45 AM           7040 Information      The start type of the Background Intelligent Transfer Servi...

   ProviderName: Microsoft-Windows-Kernel-General
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:58:27 AM             16 Information      The access history in hive \??\C:\Users\...

   ProviderName: Microsoft-Windows-WindowsUpdateClient
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:57:08 AM             19 Information      Installation Successful: Windows successfully installed the fol...

How It Works:

• Get-WinEvent reads Windows event logs directly - it's the modern replacement for the older Get-EventLog cmdlet.
• -LogName System specifies which log to read - common options include System, Application, and Security (the last one requires Administrator).
• -MaxEvents 5 limits the output to the 5 most recent entries. Without this, Get-WinEvent returns the entire log, which can be tens of thousands of entries and take a long time to process.
• The output is grouped by ProviderName - the source component that generated each event (e.g. Windows Update Client, Kernel, Service Control Manager).