How to Use Windows Event Viewer

1. Click on 'Start' in the lower-left corner of your screen, then click Control Panel and select 'Administrative Tools.' In Category view, choose 'System and Maintenance.' Select 'Event Viewer' from the list. Windows 7 and Vista users may also open the tool by typing 'Event Viewer' into the search bar in the 'Start' menu and pressing 'Enter.'
2. Click on the 'Application' option. In Windows 7 and Vista, first click the expansion button on the 'Windows Logs' folder. This list tracks application usage. It creates an event whenever a program starts, stops, crashes or experiences an error. Select an event to view its specific details.
3. Select the 'Security' option to see the history of user access. This section keeps track of which users have logged on and when, as well as the changes they have made to Windows' security systems. Use this service to determine if your computer has experienced unauthorized usage. The list also tracks Windows Firewall and other security-related applications.
4. Click on 'System' to view a log of the system's background services. This list works like the 'Application' option, but it is tailored specifically to background services. Most of the events in this section list the time and date that a particular service was started.
5. Choose an option listed under 'Applications and Service Logs' to view events that are related to specific applications or pieces of hardware. These events may also appear in other related sections. Older versions of Windows do not have this option.
6. Select a filter or search button in the right frame to locate a specific event or range of events within the selected section. You may locate events by any of their data tags, including date, type, origin and user.