Interactive Troubleshooter

Published: Aug 30, 2026

Updated: Aug 30, 2026

How to Use Event Viewer to Find Root Cause in Windows

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

An interactive root-cause diagnostic tree to systematically isolate Windows system crashes, application failures, and hardware faults using Event Viewer logs. Learn how to filter Event IDs, interpret XML payloads, and remediate underlying OS errors.

Full Diagnostic Tree & Step-by-Step Overview

What specific Windows issue or system failure are you attempting to diagnose in Event Viewer?

System abruptly restarted, crashed to a Blue Screen (BSOD), or shut down without warning
A specific application crashes, freezes on launch, or a background Windows Service fails to start
System boots slowly, experiences overall micro-freezes, or logs storage disk warnings
You need to build Custom XML filters or use PowerShell to parse high-volume log files

Which Critical or Error Event ID appears in the System log around the crash timestamp?

Event ID 41 (Kernel-Power) or Event ID 1001 (BugCheck dump created)
Event ID 6008 (Event log indicates the previous system shutdown was unexpected)

Analyze BSOD BugCheck Codes (Event ID 1001) & Kernel-Power Events (Event ID 41)

Solution:

Root Cause: Unhandled Kernel Exception, Faulty Device Driver, or Memory Corruption

Event ID 41 indicates that the system rebooted without cleanly shutting down first. When paired with Event ID 1001, Windows saved a crash dump file (MEMORY.DMP) containing the exact BugCheck code and faulting driver binary.

# Step-by-Step Fix:

Filter System Log for Crash Events:

Press Win + R -> Type eventvwr.msc -> Press Enter.

Navigate to Windows Logs -> System.

Click Filter Current Log... in the right pane -> Enter 41, 1001 into the Event ID field -> Click OK.

Extract BugCheck Code and Hex Parameters:

Select the Event ID 1001 entry -> Click the Details tab -> Select XML View.

Note the BugCheckCode (e.g., 0x0000000a = DRIVER_IRQL_NOT_LESS_OR_EQUAL, 0x0000001e = KMODE_EXCEPTION_NOT_HANDLED).

Look for Param1 or Logging data pointing to specific .sys driver files (e.g., nvlddmkm.sys, netwtw08.sys).

Inspect Crash Dump File with WinDbg:

Install WinDbg from the Microsoft Store.

Open C:\Windows\Minidump or C:\Windows\MEMORY.DMP -> Run !analyze -v to reveal the exact driver or process at fault.

Execute System File & Image Repair:

Open Command Prompt as Administrator (cmd.exe).

Run: DISM.exe /Online /Cleanup-image /Restorehealth

Run: sfc /scannow

Diagnose Thermal Shutdowns & Physical Power Delivery Drops (Event ID 6008)

Solution:

Root Cause: Hardware Thermal Cutoff or Abrupt Power Supply Unit (PSU) Voltage Drop

Event ID 6008 logs that a shutdown was unexpected without an preceding OS bugcheck. This occurs when motherboard thermal sensors force an instant power-off to protect the CPU/GPU from thermal destruction, or when AC power is abruptly lost.

# Step-by-Step Fix:

Check Thermal Event Logs:

In Event Viewer, expand Applications and Services Logs -> Microsoft -> Windows -> Kernel-Thermal -> Operational.

Look for Event ID 8 or 11 indicating CPU thermal throttling or thermal zone trip points.

Inspect Hardware Health & Power Connections:

Check CPU/GPU junction temperatures using diagnostic tools (e.g., HWMonitor or HWiNFO64) to confirm if idle temperatures exceed 60°C or load temperatures breach 95°C.

Reseat motherboard 24-pin and CPU 8-pin power cables.

Disable Fast Startup (Fixes Shutdown State Corruption):

Open Control Center -> Power Options -> Tap Choose what the power buttons do.

Click Change settings that are currently unavailable -> Uncheck Turn on fast startup -> Save changes.

Where is the application or service failure recorded in Event Viewer?

Application log displays Event ID 1000 (Application Error) or Event ID 1002 (Application Hang)
System log displays Event ID 7000, 7001, or 7034 (Service Control Manager errors)

Pinpoint Faulting Modules via Event ID 1000 & Resolve DLL Exception Code Crashes

Solution:

Root Cause: Corrupted Dynamic-Link Library (DLL) or Access Violation Exception (0xc0000005)

When a desktop application crashes, Windows logs Event ID 1000 in the Application channel, identifying the executable name, version, and the exact faulting module (DLL) that triggered the crash exception.

# Step-by-Step Fix:

Locate Faulting Module Name:

Go to Windows Logs -> Application -> Filter for Event ID 1000.

Under the General tab, examine these critical fields:

Faulting application name: (e.g., photoshop.exe)

Faulting module name: (e.g., ntdll.dll, VCRUNTIME140.dll, kernel32.dll)

Exception code: (e.g., 0xc0000005 = Memory Access Violation)

Remediate Core Runtime Dependencies:

If VCRUNTIME*.dll or MSVCP*.dll faults: Download and reinstall the latest Visual C++ Redistributable Package (both x86 and x64 builds).

If clr.dll faults: Repair or update the .NET Framework installation using the official Microsoft .NET Repair Tool.

If GPU DLL (nvwgf2um.sys / atikmdag.sys) faults: Perform a clean driver reinstallation using Display Driver Uninstaller (DDU).

Re-register Corrupted System DLL File:

Open elevated Command Prompt -> Run regsvr32.exe /u [module_name].dll followed by regsvr32.exe [module_name].dll.

Fix Service Control Manager Failures (Event ID 7000, 7001, 7034)

Solution:

Root Cause: Service Logon Account Lockout, Timeout Exceeded, or Missing Dependencies

The Service Control Manager (SCM) logs Event ID 7000 when a service fails to launch within its designated initialization window (default 30,000 ms), or Event ID 7034 when a background service process terminates unexpectedly.

# Step-by-Step Fix:

Identify the Failing Service:

Go to Windows Logs -> System -> Filter for Event IDs 7000, 7001, 7034.

Read the description: *"The [Service Name] service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion."*

Audit Service Account & Credentials (services.msc):

Press Win + R -> Type services.msc -> Press Enter.

Locate the target service -> Right-click -> Properties -> Log On tab.

Verify account credentials (if using a Domain Service Account) and ensure password is updated.

Increase Service Pipe Timeout via Registry:

Press Win + R -> Type regedit -> Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

Right-click right pane -> New -> DWORD (32-bit) Value -> Name it ServicesPipeTimeout.

Double-click -> Set Base to Decimal -> Enter Value 60000 (extends timeout to 60 seconds) -> Reboot.

What performance or storage symptom is logged in Event Viewer?

System log contains Event ID 7, 11, 51, or 153 (Disk paging, controller, or IO warnings)
Diagnostics-Performance log contains Event ID 100 series (Boot degradation & slow startup)

Resolve Disk Subsystem Retries & Storage Controller Errors (Event ID 7 / 11 / 153)

Solution:

Root Cause: NVMe/SATA I/O Packet Retries, Bad Physical Blocks, or AHCI/RAID Driver Instability

Event ID 153 (The IO operation at logical block address... was retried) and Event ID 11 (The driver detected a controller error on \Device\Harddisk\DR0) signify underlying storage hardware degradation, loose SATA data cables, or failing NAND cells.

# Step-by-Step Fix:

Filter System Log for Storage Providers:

Navigate to Windows Logs -> System.

Filter for Event IDs 7, 11, 51, 153 and Event Sources disk, storahci, nvme, stornvme.

Take note of the target drive identifier (e.g., \Device\Harddisk0\DR0).

Check Drive Health with WMIC & CHKDSK:

Open Command Prompt as Administrator.

Check SMART status: wmic diskdrive get model,status

Scan and repair drive file system structure: chkdsk C: /f /r (Type Y to schedule scan on next reboot).

Update Controller Drivers & Power Management:

Device Manager (devmgmt.msc) -> Expand Storage controllers -> Update driver for host controller.

Disable aggressive Link Power Management (ALPM) in Power Options to prevent drive sleeping mid-I/O.

Analyze Boot & Shutdown Latency Logs (Diagnostics-Performance Event ID 100 Series)

Solution:

Root Cause: Boot Degradation Caused by Slow Startup Services, Bloated Apps, or Driver Instability

Windows automatically logs dedicated boot performance metrics inside the Diagnostics-Performance channel. Event ID 100 measures total boot time in milliseconds, while Event IDs 101 through 110 break down individual application and driver bottlenecks.

# Step-by-Step Fix:

Navigate to Diagnostics-Performance Channel:

In Event Viewer, expand Applications and Services Logs -> Microsoft -> Windows -> Diagnostics-Performance -> Operational.

Filter Boot Degradation Events:

Click Filter Current Log... -> Enter Event IDs 100, 101, 102, 103, 106, 109.

Event ID 100: Main boot entry. Check BootTime in details (e.g., 55000 = 55 seconds).

Event ID 101: Application degradation (identifies specific app delaying boot, e.g., security_agent.exe).

Event ID 103: Driver initialization delay (identifies specific driver file, e.g., sysdriver.sys).

Disable Delayed Startup Apps & Services:

Task Manager (Ctrl + Shift + Esc) -> Startup apps tab -> Disable heavy startup programs.

services.msc -> Change non-critical slow services to Startup type: Automatic (Delayed Start).

How do you want to query or automate log parsing across Windows log channels?

Create custom multi-log XML views inside the Event Viewer GUI interface
Query, filter, and export log events programmatically via Windows PowerShell

Create Advanced XML Custom Views in Event Viewer GUI

Solution:

Root Cause: High Event Volume Obscuring Multi-Channel Diagnostic Patterns

Standard event views force administrators to manually switch between Application, System, and Security logs. Building custom XML queries aggregates correlated events into a single unified timeline.

# Step-by-Step Fix:

Open Custom View Creator:

Open Event Viewer -> Right-click Custom Views in left pane -> Select Create Custom View....

Configure Multi-Log Filters:

Under By log, check *Application*, *System*, and *Security*.

Check Event levels: *Critical*, *Error*, and *Warning*.

Paste XPath Query for Multi-Event Correlation:

Click the XML tab -> Check Edit query manually -> Click Yes.

Paste the following structured XPath query to track crashes, service errors, and disk failures simultaneously:

xml
<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(Level=1 or Level=2) and (EventID=41 or EventID=1001 or EventID=7000 or EventID=153)]]</Select>
    <Select Path="Application">*[System[(Level=1 or Level=2) and (EventID=1000 or EventID=1002)]]</Select>
  </Query>
</QueryList>

Save custom view as _Critical System Diagnostics for instant access.

Automate Log Parsing & CSV Export via PowerShell `Get-WinEvent`

Solution:

Root Cause: Event Viewer GUI Freezes or Responds Slowly When Parsing Large Log Files

The Event Viewer GUI (eventvwr.msc) loads log entries sequentially in single-threaded mode, causing high memory usage and UI freezes when logs exceed several gigabytes. PowerShell's Get-WinEvent uses API-level hashtables to query events in seconds.

# Step-by-Step Fix:

Open PowerShell as Administrator:

Right-click Start button -> Select Terminal (Admin) or PowerShell (Admin).

Run High-Performance Hashtable Query:

Execute the following command to retrieve all Error and Critical events from System and Application logs in the last 24 hours:

powershell
$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{
    LogName   = 'System', 'Application'
    Level     = 1, 2
    StartTime = $StartTime
} | Select-Object TimeCreated, LogName, Id, ProviderName, Message | Out-GridView

Export Specific Event IDs to CSV File for Remote Audit:

powershell
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id      = 41, 1001, 7000, 153
} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "$env:USERPROFILE\Desktop\EventLogs_Audit.csv" -NoTypeInformation

Related Diagnostic Guides

Fix Copy text (Ctrl-C or context menu) not working on browsers

Windows Credential Guard Blocking App Exclusions: How to Fix It

WordPress Redirecting to Spam Websites: How to Fix It

Malicious Browser Extensions: How to Detect and Remove Them

Unreal Engine Shader Compilation Stuttering: How to Fix It

Subscribe to StepDiag

Embed Guide on Your Website