Loading…
Loading…
Utilities / Public
Runs in your browserType an Event ID from Event Viewer, such as 4625, 7045 or 41, and see what it means and what to check next. The same ID can mean different things in different logs, so you can narrow it by log. For 4624 and 4625 you can also paste the event text to decode the logon type and failure reason.
Press Windows + R, type eventvwr.msc and press Enter.
Under Windows Logs pick Security for sign-ins and account changes, System for services, drivers and restarts, or Application for program errors. The Security log needs administrator rights, so open Event Viewer from an administrator account.
The number is in the Event ID column. Type it into the Event ID box on this page and pick the matching log.
Right-click the log, choose Filter Current Log, then type the number into the Event IDs box and click OK. Only matching events are shown.
Click the event, then in the right-hand Actions pane choose Copy then Copy Details as Text. Paste it into the optional Event text box. For IDs 4624 and 4625 the tool reads the logon type, failure reason and source address from it.
Open PowerShell as administrator. This copies the five most recent failed sign-ins. Change 4625 to any ID you want.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 5 | Format-List TimeCreated, Message | clipCommon IDs worth checking. 4625 failed sign-in, 4624 successful sign-in, 4720 new user account created, 7045 new service installed, 41 unexpected restart, 1102 audit log cleared.
Security log is empty or access denied? Run Event Viewer or PowerShell as administrator. Home editions of Windows may also not record some audit events by default.
Privacy. Event text can include user names, computer names and IP addresses. This tool reads the text in your browser and never uploads it. Redact them before sharing.