EventScope 1.0.0
Search Windows event logs

Run EventScope.exe. There is no installer. This build is for 64-bit Windows 10 and Windows 11.

The Security log requires an administrator. If access is denied, use Restart as administrator, approve the prompt, and search again.

A blank computer name, ".", localhost, or this PC's own name reads the local logs. Any other name is a remote computer. EventScope uses the account that started it unless you turn on Alternate credentials and enter a domain user. Passwords are not saved in filter presets.

If a remote query fails, remote event log access was blocked or the credentials were refused. On the target, allow the firewall rule "Remote Event Log Management", confirm the computer is online, and use an account that can read its logs.

Quick Views jump to common investigations: unexpected shutdowns, failed logons, account lockouts, service failures, disk and NTFS errors, Windows Update failures, application crashes, logon/logoff history, and RDP logons.

Event IDs accept commas, ranges, and exclusions. Examples: 4625, 7000-7034, -4634.

Search reads on a background thread. Cancel stops it. The result limit caps how many events are kept. The grid pages through that set, and the column headers sort it.

Export CSV and Export JSON write the loaded events. Save preset and Load preset store the current filter as JSON.

Look up event opens a web search for the selected event ID and source.

Demo screenshots, with no live log access:

    EventScope.exe --demo
