Windows 10: Event Viewer: Filter Administrative Events?

Discus and support Event Viewer: Filter Administrative Events? in Windows 10 Support to solve the problem; The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the... Discussion in 'Windows 10 Support' started by martinlest, Feb 19, 2021.

  1. Event Viewer: Filter Administrative Events?


    The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:

    Fixing DistributedCOM error 10016

    Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

    How do I proceed in order to filter those events from Administrative Events?

    (Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

    Thank you.

    Windows 10 Pro 18363.1379

    :)
     
    martinlest, Feb 19, 2021
    #1

  2. Win 10 Event Viewer -- cannot save filter in Custom Views

    I try to keep up a custom view for the Event Viewer. Since Win 10 was upgraded I can add exclusions such as ...-1234,-567,-89... but these are not saved upon exit from Event Viewer. Many repeated events are reported and most are not important.

    Nor can I find where the filter data is stored: registry, sys32, etc.

    Steps: Launch Event Viewer -- find one or more events in the custom view log -- launch Filter Current Custom View -- Add the events to be filtered out (including a (-)minus sign and comma separation. (note that in the current session, the events are
    removed as is expected) -- close the Filter Current Custom View (note that there is no Apply button) -- close and restart Event Viewer.

    Results: added event filter numbers are removed from the filter list -- any filter brought over from Win 8 upgrade still remain.

    Fixing this would be great. Knowing where the data is stored would also be fine.
     
    Ed C Benson, Feb 19, 2021
    #2
  3. ddelo Win User
    Export All Administrative Events to Excel

    To analyze events, from the Windows Event Viewer, there is a simple way to export all Administrative Events to Excel, with PowerShell.

    Exporting all Administrative Events to Excel is a simple two Step process, as described here:

    Step 1 - Create the Administrative Events View .xml file
    1. Open Eventviewer (%windir%\system32\eventvwr.msc)
    2. Navigate to: Event Viewer (Local) > Custom Views > Administrative Events
    3. In the “Actions” pane select “Filter Current Custom View”.
    4. Select the the XML tab.
    5. Press Ctrl+A to select all the XML code of the Custom View.
    6. Open a notepad, paste the selected code and save the file to your Desktop as AdmEvtView.xml


    Step 2 - Create the csv file with the events
    1. Download the ExportEvtCSV.zip file, which contains the script ExportEvtCSV.ps1 and unzip it, on your Desktop.
      It's not a fancy script, just basic PowerShell commands to create a csv file on the Desktop.
    2. In Windows Search, type “ISE” (without the quotes) to open “Windows PowerShell ISE” and Run as administrator
    3. To allow running the script, change the ExecutionPolicy, for this session. To do that, in the Console pane type:
      Code:
    4. In the Windows PowerShell ISE, open and run the script: ExportEvtCSV.ps1
      The script will create a csv file with a name YYYYMMDD.HHMM.csv on the Desktop
    5. When done, open the newly created .csv file, format the columns as needed and optionally save it as .xlsx, if you wish.
    That’s it! You now have all the Administrative Events in Excel for filtering and further analysis. Event Viewer: Filter Administrative Events? :)

    Now to the more technical hard stuff... *Confused

    There is a reason for running the script from within PowerShell ISE!

    It would be great if everything was also working perfectly, when running the script from an elevated PowerShell too.

    We can run it from an elevated PowerShell, which means that you just follow the Step 1, as above but for the Step 2 instead of the ISE you run the script from an elevated PowerShell.

    The problem is that it will work only for anybody who has en-US format for the dates. Everyone else, who has another format (i.e. en-GB, fr-FR, el-GR etc.), the dates are not translated properly by Excel (although the script uses the –UseCulture switch) and remain as text in the en-US format.

    I'm not sure if this a bug of the "export-csv" cmdlet, but although it runs the way it supposed to from within the ISE, from PowerShell there is a problem with the dates format.
    As I haven’t found a way to overcome this obstacle, any suggestion from the PowerShell gurus of the forum (like my good friend Shawn @Brink, for instance), is welcome.
     
    ddelo, Feb 19, 2021
    #3
  4. alpha45 Win User

    Event Viewer: Filter Administrative Events?

    Filter in the event viewer.

    Hi,
    is it possible to create a filter by manually editing the XML query in the event viewer and have the entered query remain stored in the log even if I close the event viewer?
    Thanks
     
    alpha45, Feb 19, 2021
    #4
Thema:

Event Viewer: Filter Administrative Events?

Loading...
  1. Event Viewer: Filter Administrative Events? - Similar Threads - Event Viewer Filter

  2. event viewer

    in Windows 10 BSOD Crashes and Debugging
    event viewer: event viewer is usless. show me how it is helpful. https://1drv.ms/u/s!ArXmGzW0FYlH0xP0iAr1ou5Ikj9b?e=kGGiQd here is my events. tell me why it blue screened? https://answers.microsoft.com/en-us/windows/forum/all/event-viewer/8f2b1248-20c5-4dbd-a982-ef5fcc8091e4
  3. Filter in the event viewer.

    in Windows 10 Support
    Filter in the event viewer.: Hi, is it possible to create a filter by manually editing the XML query in the event viewer and have the entered query remain stored in the log even if I close the event viewer? Thanks 170228
  4. Event Viewer

    in Windows 10 Support
    Event Viewer: Any way to capture the Warnings and Errors as they happened. I had a BSOD problem associated with Team Viewer and certain links when attempting to open. That has been cleared, appearently by a W-10 update, not by me. The BSOD has disappeared and everything opening normally....
  5. Event Viewer

    in Windows 10 BSOD Crashes and Debugging
    Event Viewer: Is there a website or a program I can download preferably free, but willing to buy that will explain the information in and how to use the Event Viewer. I am not experiencing any problems using my computer but I like to learn. Seeing all the info that is logged by my computer...
  6. Event Viewer

    in Windows 10 BSOD Crashes and Debugging
    Event Viewer: Hi, Why there is no Search option in the Event Viewer? People like myself would like to find out if their "application name", "hardware name" etc would appear ini any of the logs and troubleshoot it that way. Right now for some reason after upgrading Arduino to the latest...
  7. Bug in Event Viewer - Filter Current Log by Event Source

    in Windows 10 Support
    Bug in Event Viewer - Filter Current Log by Event Source: I found a bug trying to view the Event Log on both my v 1803 PCs for the Option Filter Current Log by Event Source. Nothing appears in the drop down list unless the screen scaling is set to 100%. This strange behaviour is supported by many users based on a Google search. It...
  8. Event Viewer

    in Windows 10 Performance & Maintenance
    Event Viewer: Is there any way to clear the items listed in 'administrative events' in event viewer? TIA, Richard 98433
  9. Event Viewer TDI filter warning

    in Windows 10 Performance & Maintenance
    Event Viewer TDI filter warning: Hello, I am receiving this error in Event Viewer: A TDI filter (\Driver\adgnetworktdidrv) was detected. This filter has not been certified by Microsoft and may cause system instability. I'm not sure what this means. Is it something that can be ignored or is it important?...
  10. Event Viewer

    in Windows 10 Support
    Event Viewer: I had a problem with Lockheed Martins P3DV4 software earlier this week which has now been resolved. As part of the trouble shooting process I used Windows Event Viewer to track down the issue. While using Event Viewer I noted it is a "busy" piece of software with...