Windows Commands / IT Support Guides
Read recent Windows errors with Get-WinEvent
Reproducing a failure and immediately inspecting its event window can reveal a useful provider and event ID. Restrict the query to avoid drowning the ticket in unrelated history.
Environment and inputs: Windows 11 · Command Prompt unless PowerShell is specified
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 20 | Select-Object TimeCreated, Id, ProviderName, MessageHow to read the result
The filter requests recent error-level System events. An empty result means no matching accessible entries were returned, not that the whole computer is healthy.
What to do next
Compare the timestamps with the exact failure and inspect the relevant provider's message. Include the ID and sanitized message when escalating instead of relying on the event ID alone.
Before you make a change
Some logs require elevation. Event messages may contain personal data, file paths or internal hostnames.