How to Review Events in Windows 7 and Vista

By Dan Gookin

Windows keeps track of event details in log files. Just about anything that goes on in the computer — from a user logging in to programs crashing to routine tasks being scheduled — is noted in a log somewhere. The first place to check for your PC’s recent activities and happenings is the Event Viewer. In Windows 7 and Windows Vista, obey these steps:

  1. Open the Control Panel.

  2. Open the Administrative Tools icon.

    • In Windows 7, choose System and Security and then Administrative Tools.

    • In Windows Vista, choose System and Maintenance and then Administrative Tools.

  3. Open the Event Viewer icon.

    Not every event is a nasty one; most are informational, which means that something happened and was noted in the log.

    In Windows Vista, click the Continue button or type the administrator’s password to get beyond the UAC warning.


  4. Open the Windows Logs folder on the left side of the Event Viewer console window and choose the item Application.

    Not every event is a nasty one; most are informational, which means that something happened and was noted in the log.

  5. Double-click an event to view its details.

    You can either double-click or just click as the details are shown in the bottom center of the Event Viewer window.


  6. Double-clicking an error event.

    You create a custom view. Essentially, you make an event filter that shows information about the error or another event.


    For instance, you might see an ACPI BIOS error message. (ACPI is the Advanced Configuration and Power Interface, or the computer’s power management hardware.) In which case, you would contact the system vendor for an update as suggested by the Event Viewer.

  7. Close the Event Viewer window when you’re done.

Event Categories
Log Type of Events That Are Monitored
Application Third-party programs; anything that’s not Windows
Forwarded Events Events on network computers (with a subscription set up in
order to see these types of events.)
Internet Explorer Problems with Internet Explorer
Security Logon/logoff events, file deletions, and events pertaining to
Setup Events relating to application setup and configuration
System Things that go on in Windows itself, such as start-up events
and device driver failure
Event Types
Type Description
Error Something bad happened, such as a service failed or data was
Failure Audit Something was attempted that didn’t work, such as an
illegal login or an attempt by a non-administrator to access
administrator-level features.
Information Something happened successfully.
Success Audit Something was attempted and worked out, such as logging in to a
remote PC; the opposite of a failure audit.
Warning An event occurred that is worth noting but isn’t
specifically an error.