How to Export the Windows Event Viewer “Administrative Events” for Technical Support

Issue:

You need to find and export the Windows “Administrative Events” to a .evtx file to provide to Technical Support.

Solution:

Windows has several types of logs that Support can use to diagnose problems with your system and software.  Once of these is the Windows Event Viewer.  These steps work for Windows 10 and Windows 11.

1. In Windows click the Windows start button and type “Event Viewer”
2. Click the “Run as administrator” link/button.  If you are unable to "Run as administrator", then please contact your IT for assistance.
   
    
3. In the Windows Event Viewer expand out “Custom Views” and select “Administrative Events”
4. On the right sidebar menu under “Actions” click “Save All Events in Custom View As…”.  If you are unable to see "Custom Views" or "Administrative Events", then please contact your IT for assistance.
5. Verify it is being saved to *.evtx and save it to a location you can easily find. 
   
    
6. Select the option to “Display information for these languages:” and verify “English (United States) is selected then click Ok.
   
7. Once saved, email the file to your Support Technician.

The .evxt file has a lot of information and can take time to sort through.  To help narrow down the list you should also provide the date & time of the last time you experienced the problem.

About the Author

Sr. Technical Support Specialist - Licensing<br><br>I am charged with mentoring and training team members in the proper use our systems and tools, documenting NSC processes, and providing feedback and ideas to the management team towards improving the customer experience. I am also a major contributor to our technical support blog and internal knowledge base.

Follow on Linkedin More Content by Jeff Lotan