Windows 10: How can I "Un-Edit" default view in Custom Views of the Event Editor

Hello all. Seems like I have managed to screw up the default "Administrative Events" in the Custom Views section of the Event Viewer. I filtered it for warnings, etc., intending to save as a new definition, but in fact managed to apply the filter to the default definition itself. Doh! Now, I can't unfilter or delete it - the options are greyed out in the editor. Anyone know how to reset that item to default?

Using build 1703. Must be a bug that permitted me to edit that view in the first place?


:)

 

How to zoom into large pictures with Belle ?

The photo editor will zoom in much more than the gallery. Either open it from the menu or "three bar " then edit when viewing the photo in gallery.

 

In the Event Viewer, can I set a Custom View to default?

I wanted it so that every time I open the Event Viewer that the Warnings and Errors show first.

 

Can you take a screen shot of the greyed out thing you're talking about?

 

Try changing the Table View Event Viewer - How To

 

Under Custom views of the Event Viewer: Right click Administrative Events => Properties => Edit Filter and you should get a read only Custom View Properties window. But somehow, in my case I inadvertently edited it before it became read only, and I can't see how to get back the default.




@spunk - Not clear how to do that. There's no "User Preferences" in the Win 10 Control Panel. Where is the "CommCell Console" ? But sure, I can make my own custom unfiltered view - which I did (see screen capture.) I'm just wondering how to reset the default. And why Win10 let me edit it in the first place.

 

Same thing applies here.

I'm assuming it's a custom setting that Microsoft has made that is un-editable.
Check out my picture:

 

Ah, but you did edit it. That's the point. We just can't UN-edit it. In C:\ProgramData\Microsoft\Event Viewer\Views one finds an .xml file definition for each user-created custom view, but no definition for this default "custom view." So how did WIN 10 let us edit it? A small mystery. I've searched my drive for a string of text that I'd entered in the description field. Registry too. No luck. It must be encoded somewhere.

 

I've never created that custom thing; It was already there. I had to figure out what you did to make my screen shot look like yours. After I set it all up to take the screen shot, I noticed that it looks exactly like yours. I've never touched that Event Viewer thing, I've only glanced at the errors in there a few times only; never made modifications.

But yea, try searching online on ways to alter it.

 

I don't have my Win10 machine handy to check right now, but I checked my Win7Pro C:\ProgramData\Microsoft\Event Viewer\Views folder and found nothing but an empty C:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode folder (no .xml files). I don't think I've ever customized the view, as I usually use NirSoft's MyEventViewer (much simpler and more flexible for my needs).

Could it be that the custom .xml file(s) you have are created only when you customize the view, & otherwise Windows uses its own default view? Given the ProgramData path, I'm guessing the folder would only contain data/settings generated by User usage. Perhaps you could check that by temporarily moving or renaming the existing .xml file(s) and seeing if the view reverts to default. (...might require a reboot but I'm guessing not)

 

Gad, my apologies. I was so sure that when I first looked to edit that view, it had no check marks at all; IOW, that it gave ALL events. Now I see your check pattern is the same as mine, and so is your description. *Confused Could've sworn I'd changed mine, but guess not. Too many hours dealing with a crashed boot drive I guess.

Perhaps someone else could confirm that the "three checks" template is the default, but I apologize for even starting this thread.
@gdv - Yes, an XML file is created when you create a new custom event profile.

 

I completely understand. There's so much complexity in so much stuff with this OS, that anyone can easily get lost. Yes, it is best if somebody else can also confirm that what they're seeing is also the same.

 

As near-certain confirmation (still don't have my Win10 machine available), the checked boxes and description on my Win7Pro default Administrative View Properties appear to be identical to both of your Win10 examples:

@rkl122: Since you seem to have been recalling/expecting something that neither pepanee nor I are seeing, it is a bit difficult to replicate. But 2 possibilities occur to me:

(1) I notice in your screenshot you have views named 'Administrative Events' and 'Administrative Events (1)', which I am able to replicate by copying 'Administrative Events' without assigning a new name, but 'Administrative Events' remains Read-Only, while 'Administrative Events (1)' is editable. Do they both have identical properties (e.g. checkmarks)? Is that by any chance part of the source of the original confusion (e.g., you edited out the checkmarks but didn't change the name)?

(2) I wonder if you're recalling a different dialog window, which does in fact open with no checkmarks, at least on my Win7Pro machine (Action > Create Custom View...):






From my reading of your posts (especially "when I first looked to edit that view"), possibility #2 seems more likely to me than #1.

 

I'd deliberately done the same thing hoping to replace the original with what I thought was the default filter, but as you found, that just creates the (1) version. Yes your possibility 2 is closer to the truth, which amounts to what I'm embarrassed to conclude is user brain malfunction. I didn't realize at first that the default custom view is completely read only and simply mis-remembered its configuration. (That MS would put a read-only template under "Custom" is perhaps questionable, but I guess they intended it as an example.)

Thank you gdv for taking the time. Again my apologies for wasting it.

 

...of course ya know you don't have any exclusive corner on brain malfunctions! *Wink

Certainly MS UIs don't always make perfect sense, but you got me thinking about that. I guess it qualifies as "Custom" because it (1) includes events from numerous pre-selected nodes on the Event Viewer tree (Application, Security, Hardware Events, etc.), and (2) limits the type of events displayed to Critical, Error, and Warning only, whereas all the other views on the tree include all Event Levels but for only one category each (Application, Security, Hardware Events, etc.). ...But that was probably already apparent to you, as you've clearly been using Event Viewer more than I have. (I.e., you probably didn't mean it should have been placed somewhere else in the tree.)

I agree it makes a very useful example, and I imagine IT folks might especially appreciate it as-is, and also as a starting point for further customization. It includes a fairly complex selection of nodes from the tree, so having it be Read-Only seems like a good idea so it remains in its very useful default configuration.

BTW (in case you haven't already thought of it), if you want to protect your own custom views from unwanted/accidental modification, I tested and verified that changing the file Properties > Attributes of the relevant .xml file (in C:\ProgramData\Microsoft\Event Viewer\Views) to Read-only will prevent the corresponding custom view from being modified from within Event Viewer.

You're welcome, but I don't at all feel my time was wasted. I like digging into problems like this both to try to help others, and for what I learn in the process. ...And I've learned a lot in the time I've spent on this one. I'll probably continue to use NirSoft's MyEventViewer for most of my quick Event Viewer needs, but now I have a much greater appreciation for the power and sophistication of the current MS Event Viewer (which I've mostly avoided since leaving WinXP) and how I might use it for particular problems in the future.

Glad we both got it sorted out! ---Regards