How to Query and Export Windows Event Logs in Windows 11 Using PowerShell

When diagnosing sudden application crashes, investigating Blue Screen of Death (BSOD) reboots, auditing failed logon attempts, or conducting cybersecurity forensics on a Windows 11 PC, the operating system’s native Event Log repository is your primary investigative source. While the graphical Event Viewer console (eventvwr.msc) is familiar, it is notoriously sluggish when loading deep log trees containing tens of thousands of entries.

For rapid querying, granular multi-property filtering, and automated report generation, PowerShell provides the high-performance Get-WinEvent cmdlet. Replacing the legacy, deprecated Get-EventLog cmdlet, Get-WinEvent interfaces directly with the modern Windows Event Log API. Here is how to query, filter, and export Windows event logs in Windows 11 using PowerShell.

Step 1: Open an Elevated PowerShell Session

While querying the Application or System log is permitted for standard users, reading the high-security Security log requires administrative rights:

1. Right-click the Start button on your Windows 11 taskbar (or press Windows Key + X).
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes when prompted by the User Account Control (UAC) dialogue.

Step 2: List and Inspect Available Event Logs

Windows 11 maintains dozens of traditional and modern Event Tracing for Windows (ETW) logs. To view the primary standard logs and their current record counts, execute:

Get-WinEvent -ListLog Application, System, Security | Format-Table LogName, RecordCount, IsClassicLog, FileSize

To search for specific operational logs (for example, logs relating to Windows Defender, Task Scheduler, or OpenSSH), use wildcard pattern matching:

Get-WinEvent -ListLog *Defender* | Select-Object LogName, RecordCount

Step 3: Query Recent Events from the System or Application Log

To quickly retrieve the most recent events from a log, use the -LogName and -MaxEvents parameters:

Get-WinEvent -LogName System -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

This command pulls the 20 most recent entries from the System log, formatting the timestamp, Event ID, severity level (Information, Warning, Error), and message description.

Step 4: Use FilterHashtable for High-Speed Filtering

The biggest performance mistake administrators make in PowerShell is piping thousands of raw log entries into Where-Object. This forces PowerShell to deserialize every single log record into memory. Instead, use the -FilterHashtable parameter, which executes the filter directly on the low-level Windows Event Log engine before returning data:

Filtering All System Errors in the Past 24 Hours

$Filter = @{
    LogName   = 'System'
    Level     = 2  # Level 1 = Critical, 2 = Error, 3 = Warning, 4 = Information
    StartTime = (Get-Date).AddDays(-1)
}
Get-WinEvent -FilterHashtable $Filter | Select-Object TimeCreated, Id, ProviderName, Message

Filtering Specific Security Event IDs (e.g. Failed Logons)

To investigate brute-force or unauthorized logon attempts, query Event ID 4625 (An account failed to log on) in the Security log:

$Filter = @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddDays(-7)
}
Get-WinEvent -FilterHashtable $Filter | Format-Table TimeCreated, Id, Message -Wrap

Auditing System Shutdowns and Restarts (Event ID 1074)

To find out who initiated a PC shutdown or which application requested a reboot:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 10 | Select-Object TimeCreated, Message | Format-List

Step 5: Export Filtered Event Logs to CSV for Analysis

Once you have isolated target events, you can export the structured data to a CSV spreadsheet for auditing, ticket attachments, or sharing with an IT security team:

$Filter = @{
    LogName   = 'System'
    Level     = 1, 2  # Critical and Error levels
    StartTime = (Get-Date).AddDays(-7)
}

Get-WinEvent -FilterHashtable $Filter | Select-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message |
    Export-Csv -Path "$HOME\Desktop\System_Errors_Report.csv" -NoTypeInformation -Encoding utf8

This generates a clean, spreadsheet-ready CSV file on your desktop with all fields properly escaped.

Step 6: Export Raw Event Logs to EVTX Format

If you need to archive an entire binary log file to preserve digital signatures and raw structures for official forensic investigations, use the companion wevtutil utility:

wevtutil epl System "C:\Logs\System_Archive.evtx"

The resulting .evtx file can be imported into any Windows machine’s Event Viewer or ingested by enterprise SIEM platforms (such as Microsoft Sentinel or Splunk).