How to Create Custom Views in Windows Event Viewer to Filter Security Logs

Windows Event Viewer is one of the most underutilised diagnostic tools in the Windows operating system. It continuously records thousands of events from every component of the system—hardware drivers, application crashes, security audit trails, and kernel-level operations. However, for most administrators and power users, opening Event Viewer is an exercise in frustration. The default views present an overwhelming, unfiltered wall of log entries that makes finding the specific event you need feel like searching for a needle in a haystack.

Custom Views solve this problem by allowing you to create persistent, filtered views that display only the events you care about. Instead of scrolling through tens of thousands of informational messages to find the single failed logon attempt or the driver error that caused a blue screen, you can build a Custom View that pre-filters by event level, event source, event ID, or even specific keywords within the event data. Once created, these views are saved permanently and update automatically every time you open Event Viewer.

Why Default Event Viewer Views Are Not Enough

When you open Event Viewer (eventvwr.msc), the built-in logs are divided into broad categories: Application, Security, Setup, System, and Forwarded Events. Each category can contain hundreds of thousands of entries. The Security log alone, on an Active Directory domain controller, can generate millions of entries per day. Without filtering, you would need to manually scan every entry to find the specific events you need.

Custom Views allow you to combine filters across multiple logs simultaneously. For example, you could create a single view that shows all Error and Critical events from both the Application and System logs, giving you an instant dashboard of every serious problem on the machine. You could also create a view that shows only Event ID 4625 (Failed Logon Attempts) from the Security log, giving you an immediate audit trail of potential brute-force attacks.

How to Open Windows Event Viewer

There are several ways to open Event Viewer in Windows 11 and Windows 10:

• Start Menu search: Press the Windows key, type Event Viewer, and select the result.
• Run dialogue: Press Win + R, type eventvwr.msc, and press Enter.
• Right-click Start: Right-click the Start button (or press Win + X) and select Event Viewer.
• Command Prompt or PowerShell: Type eventvwr and press Enter.

Event Viewer opens with a summary view on the right. In the left-hand navigation pane, you will see Custom Views at the top of the tree, followed by Windows Logs and Applications and Services Logs underneath.

How to Create a Custom View

Follow these steps to create a Custom View that filters events by level, source, and event ID:

1. In Event Viewer, right-click Custom Views in the left pane and select Create Custom View.
2. The Create Custom View dialogue box opens. This is where you define your filter criteria.
3. Under Logged, select the time range. For ongoing monitoring, choose Any time. For recent troubleshooting, choose Last 24 hours or Last 7 days.
4. Under Event level, tick the boxes for the severity levels you want to include. For a troubleshooting dashboard, select Critical, Error, and Warning. Leave Information and Verbose unticked to reduce noise.
5. Under Event logs, click the dropdown and expand Windows Logs. Tick the logs you want to monitor. For example, tick both Application and System for a general health dashboard.
6. If you need to filter by a specific Event ID, enter the ID number in the Event IDs field. You can enter multiple IDs separated by commas (e.g., 4625, 4648, 4776) or use ranges with hyphens (e.g., 4624-4634).
7. Click OK.
8. In the Save Filter to Custom View dialogue, give your view a descriptive name (e.g., “Critical System Errors” or “Failed Logon Attempts”).
9. Optionally, create a new folder under Custom Views to organise your views by purpose (e.g., “Security Auditing”, “Performance Monitoring”).
10. Click OK to save.

Your Custom View now appears in the left-hand pane under Custom Views. It automatically updates every time you open Event Viewer, showing only events that match your filter criteria.

Practical Custom View Examples

Failed Logon Attempts (Security Auditing)

This view monitors failed authentication attempts, which is essential for detecting brute-force attacks against local accounts, RDP sessions, or domain credentials.

• Event level: All levels
• Event log: Security
• Event IDs: 4625, 4771

Event ID 4625 records every failed logon attempt on the local machine, including the account name, source IP address, and failure reason (e.g., bad password, expired account, locked account). Event ID 4771 records Kerberos pre-authentication failures, which occur when a domain user enters the wrong password against a domain controller. Together, these two Event IDs provide a comprehensive failed authentication audit trail.

Critical System Health Dashboard

This view provides an instant overview of every serious system problem—driver crashes, service failures, disk errors, and kernel panics.

• Event level: Critical, Error
• Event logs: Application, System
• Event IDs: Leave blank (include all errors)

By excluding Warning, Information, and Verbose events, this view cuts through thousands of benign log entries and shows only the events that represent genuine system failures. This is invaluable when diagnosing blue screens (Bug Check events appear here), application crashes (Application Error events), and service start failures.

Windows Update Failures

Failed Windows Updates are a persistent source of frustration. This Custom View isolates update-related failures for quick diagnosis.

• Event level: Error, Warning
• Event logs: System, Setup
• Event sources: Microsoft-Windows-WindowsUpdateClient, Microsoft-Windows-Servicing

This view captures events such as failed update downloads, installation rollbacks, and component store corruption warnings. The error codes in these events (e.g., 0x80070002, 0x800F081F) can be cross-referenced with Microsoft’s documentation to pinpoint the exact cause of the update failure.

Filtering Custom Views Using XML Queries

The graphical filter in the Create Custom View dialogue covers the most common scenarios, but it has limitations. For advanced filtering—such as filtering by specific data within an event’s XML payload—you need to use the XML tab in the Create Custom View dialogue.

To switch to XML mode:

1. In the Create Custom View dialogue, click the XML tab.
2. Tick Edit query manually. Event Viewer warns that you cannot switch back to the graphical filter after editing the XML. Click Yes.
3. Enter your custom XPath query.

For example, the following XML query filters the Security log for failed logon attempts (Event ID 4625) where the failure reason was a bad password (SubStatus 0xC000006A) and the target account was “Administrator”:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4625)]]
      and
      *[EventData[Data[@Name='SubStatus']='0xc000006a']]
      and
      *[EventData[Data[@Name='TargetUserName']='Administrator']]
    </Select>
  </Query>
</QueryList>

XML queries provide surgical precision. You can filter by any field within the event’s XML data, including IP addresses, process IDs, service names, and error codes that are not accessible through the graphical filter.

How to Export and Import Custom Views

Custom Views can be exported as XML files and imported on other machines, making them ideal for standardising monitoring across an organisation.

To export: Right-click the Custom View in the left pane, select Export Custom View, and save the XML file to a shared location.

To import: Right-click Custom Views in the left pane, select Import Custom View, and browse to the XML file.

This feature is particularly useful in enterprise environments where IT teams can create a standard set of Custom Views for security auditing, performance monitoring, and compliance reporting, then deploy them across all managed machines via Group Policy or a configuration management tool.

Attaching Tasks to Custom View Events

Windows Event Viewer can trigger automated actions when specific events appear in a Custom View. This is achieved through the Attach Task To This Event feature, which creates a Windows Task Scheduler trigger based on the event.

To attach a task:

1. Open your Custom View.
2. Right-click a specific event in the results list.
3. Select Attach Task To This Event.
4. The Create Basic Task Wizard opens, pre-configured with the event’s log name and Event ID as triggers.
5. Choose an action: Start a program, Send an e-mail (deprecated but still functional via workarounds), or Display a message.
6. Complete the wizard.

For example, you could configure a task that runs a PowerShell script every time a Critical error appears in the System log. The script could send an email notification, write to a central monitoring database, or trigger a service restart.

Using PowerShell as an Alternative to Custom Views

For administrators who prefer the command line, PowerShell provides equivalent functionality through the Get-WinEvent cmdlet. This cmdlet can query Event Viewer logs using the same filter criteria available in Custom Views, and it supports XPath queries and hashtable-based filters.

To retrieve all failed logon attempts from the Security log:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | 
  Select-Object TimeCreated, Message | 
  Format-List

To retrieve Critical and Error events from both the Application and System logs in the last 24 hours:

Get-WinEvent -FilterHashtable @{
  LogName = 'Application', 'System'
  Level   = 1, 2
  StartTime = (Get-Date).AddDays(-1)
}

PowerShell is particularly powerful for automated reporting. You can schedule a script to run daily, query the relevant events, and email a formatted report to the IT team—effectively creating a fully automated monitoring solution without third-party tools.

Common Mistakes When Using Custom Views

• Including too many event levels: Adding Information and Verbose levels to a Custom View designed for troubleshooting defeats the purpose. These levels generate thousands of benign entries that obscure genuine problems.
• Filtering by a single log: Many system problems span multiple logs. A driver crash might appear in the System log while the application that triggered it logs its error in the Application log. Custom Views that span multiple logs provide a more complete picture.
• Ignoring the time filter: On machines with months of logs, a Custom View set to “Any time” may take several minutes to load. Use time-based filters to improve performance.
• Not using Event IDs: Every Windows event has a unique Event ID that identifies exactly what happened. Learning the critical Event IDs for your environment (e.g., 4625 for failed logons, 41 for unexpected shutdowns, 1001 for application crashes) dramatically improves your ability to create targeted Custom Views.

Important Event IDs for Security Monitoring

The following Event IDs are commonly used in security-focused Custom Views:

Event ID	Log	Description
4624	Security	Successful logon
4625	Security	Failed logon attempt
4648	Security	Logon using explicit credentials (RunAs)
4720	Security	User account created
4722	Security	User account enabled
4725	Security	User account disabled
4726	Security	User account deleted
4732	Security	Member added to a local group
4756	Security	Member added to a universal group
1102	Security	Audit log cleared (potential tampering)

Creating Custom Views based on these Event IDs provides a powerful, built-in security monitoring capability without requiring expensive third-party SIEM solutions. While dedicated tools like Splunk or Microsoft Sentinel are superior for enterprise-scale monitoring, Custom Views provide immediate, actionable visibility for individual servers and workstations.