New answers tagged


Don't change the value in the registry, this may lead to unexpected behaviour. You can use Powershell, but not Limit-EventLog, because the documentation says that this works only on classic event logs (before Windows Vista). The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use ...


No, they are different log files on the disk. You can right-click on a log file -> Properties, and Windows will show you the file location. The only thing you can do is create a "Custom View" (at the top of your screenshot) and select the events to be shown in your custom view.


I have many 4648 events on my main machine, for me this happens every time I am logged-in as a standard user and then run a new process as a different user, usually an administrator. You can do this with runas.exe or Start-Process -verb runas, or in the GUI content menu Run as a different user or Run as administrator. It may also happen when a scheduled ...

Top 50 recent answers are included