Windows event logs: event IDs, Get-WinEvent and XPath

Start DC01, SRV01 and CL01. Work as SAATLAB\adm.rahul in PowerShell as administrator unless a step says otherwise.

1List the logs and their sizes

On SRV01:

Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
    Where-Object RecordCount -gt 0 |
    Sort-Object RecordCount -Descending |
    Select-Object -First 6 LogName, RecordCount,
        @{ n = 'MaxMB'; e = { [math]::Round($_.MaximumSizeInBytes / 1MB) } }, LogMode

You’ll see something like this:

LogName                                     RecordCount MaxMB LogMode
-------                                     ----------- ----- -------
Security                                          31842   128 Circular
System                                             6120    20 Circular
Application                                        2875    20 Circular
Microsoft-Windows-PowerShell/Operational           2210    15 Circular
Windows PowerShell                                 1460    15 Circular
Microsoft-Windows-TaskScheduler/Operational        1102    10 Circular

Circular means “overwrite as needed”: when the log is full, the oldest events go. The bigger and busier the log, the more history you keep, or lose.

✅ Checkpoint: You can see each log’s record count, size limit and retention mode.

2Filter the slow way and the fast way

On SRV01, find errors in the System log from the last 7 days, both ways:

$since = (Get-Date).AddDays(-7)
(Measure-Command {
    Get-WinEvent -LogName System | Where-Object { $_.Level -eq 2 -and $_.TimeCreated -ge $since }
}).TotalSeconds

(Measure-Command {
    Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 2; StartTime = $since } -ErrorAction SilentlyContinue
}).TotalSeconds

You’ll see something like this:

3.9417318
0.1288421

Where-Object reads every event into PowerShell first, then throws most away. FilterHashtable asks the event log service to filter, so only matching events come back. On a busy DC with millions of Security events, that’s the difference between seconds and many minutes.

✅ Checkpoint: FilterHashtable is many times faster than Where-Object for the same result.

3Read failed logons with XPath

On CL01, type a wrong password three times on purpose (normal PowerShell):

1..3 | ForEach-Object { net use \\DC01\IPC$ /user:SAATLAB\kiran.das WrongPass1 }

You’ll see something like this (three times):

System error 1326 has occurred.

The user name or password is incorrect.

On DC01, find those failures and pull out the useful fields:

$xpath = "*[System[EventID=4625] and EventData[Data[@Name='TargetUserName']='kiran.das']]"
Get-WinEvent -LogName Security -FilterXPath $xpath -MaxEvents 3 | ForEach-Object {
    $d = @{}
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]@{
        Time      = $_.TimeCreated
        User      = $d.TargetUserName
        IP        = $d.IpAddress
        LogonType = $d.LogonType
        SubStatus = $d.SubStatus
    }
} | Format-Table

You’ll see something like this:

Time                User      IP         LogonType SubStatus
----                ----      --         --------- ---------
19/10/2026 14:02:31 kiran.das 10.0.0.150 3         0xc000006a
19/10/2026 14:02:31 kiran.das 10.0.0.150 3         0xc000006a
19/10/2026 14:02:30 kiran.das 10.0.0.150 3         0xc000006a

Logon type 3 is a network logon, the IP shows it came from CL01, and sub status 0xC000006A means a wrong password. Other codes you’ll meet: 0xC0000064 (user doesn’t exist), 0xC0000234 (locked out), 0xC0000072 (account disabled).

✅ Checkpoint: You found three 4625 events with user, source IP and sub status.

4Build a daily event summary

On SRV01, count the events from the cheat sheet over the last 24 hours:

$ids   = 41, 104, 1074, 6008, 7031, 7034, 7040, 7045
$start = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = $ids; StartTime = $start } -ErrorAction SilentlyContinue |
    Group-Object Id |
    Sort-Object Count -Descending |
    Select-Object @{ n = 'EventId'; e = { $_.Name } }, Count,
        @{ n = 'Last'; e = { ($_.Group | Sort-Object TimeCreated)[-1].TimeCreated } }

You’ll see something like this:

EventId Count Last
------- ----- ----
7040        4 19/10/2026 13:10:51
1074        1 19/10/2026 12:31:08
6008        1 19/10/2026 13:22:09
41          1 19/10/2026 13:21:58
104         1 19/10/2026 13:10:44

Run this every morning (or schedule it, as in Lesson 27) and you’ll spot crashes, restarts and service changes before users report them.

✅ Checkpoint: The summary shows counts and the last time for each important System event.

5Optional: trace live with DTrace

On SRV01 (Server 2025), enable DTrace and restart:

bcdedit /set dtrace on
Restart-Computer

After the restart, count system calls per process for a few seconds, then press Ctrl+C:

dtrace -n "syscall:::entry { @[execname] = count(); }"

You’ll see something like this:

  svchost.exe                                                    1844
  lsass.exe                                                      2210
  MsMpEng.exe                                                    5932
  System                                                         9120

[Add your screenshot here]

DTrace shows what is happening right now, below the level of events. Use it when a process is busy but the logs are quiet. Turn it off again with bcdedit /set dtrace off and a restart when you’re done.

✅ Checkpoint: dtrace lists processes with their system call counts.