Hi, I am currently trying to discover a way to get a listing of every possible Windows Event ID and associated description? For example I am interested in a listing of every POSSIBLE Windows Event ID for the following in Event Viewer: Active Directory Web Services DFS Replication Directory Service DNS Server I cannot find a way to do this, and have only been successful in listing events for these categories that have already triggered. Note: wevtutil gp "Active Directory Web Services" /ge /gm:true does not work. Kind regards, James

Hi, Thank you for your patience and reply. If the information provided by me and the MVP is not helpful to you. I might suggest that you go to Microsoft to open a consulting case. A senior engineer may be able to give you a more comprehensive suggestion. reference: https://support.microsoft.com/en-in/hub/4343728/support-for-business Hope this information can help you Best wishes Vicky

I'm not aware of any recent tools. The event log source and event IDs are ever changing as well. --please don't forget to upvote and Accept as answer if the reply is helpful--

Hi， Thank you for posting in our forum: You just want to know all the errors, do you? If so, then the link below may be helpful to you https://adamtheautomator.com/windows-security-events/ https://superuser.com/questions/394422/list-of-all-windows-7-event-ids-and-sources https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx Thank you for your understanding and support Best wishes Vicky

Hi, Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance. Best Regards, Vicky

List every possible Windows Event ID

James Ward-Smith 21

Hi,

I am currently trying to discover a way to get a listing of every possible Windows Event ID and associated description?

For example I am interested in a listing of every POSSIBLE Windows Event ID for the following in Event Viewer:

Active Directory Web Services
DFS Replication
Directory Service
DNS Server

I cannot find a way to do this, and have only been successful in listing events for these categories that have already triggered.

Note: wevtutil gp "Active Directory Web Services" /ge /gm:true does not work.

Kind regards,

James

INTREPID 41 Reputation points

2021-11-18T22:26:18.843+00:00

EventID.net has been offline for weeks. It looks like they're out of business. It's odd that I can't find any information online about their departure. Anyone know what's going on with EventID.net ? Thanks.
Joseph Vossler 1 Reputation point

2022-01-27T01:50:29.447+00:00

Here you go:

Windows 10 and Windows Server 2016 security auditing and monitoring reference:
https://www.microsoft.com/en-us/download/details.aspx?id=52630

Windows Security Log Encyclopedia:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx
Vittal Sher SHER 0 Reputation points

2025-02-25T17:56:51.6066667+00:00

Here is one more list - https://www.microsoft.com/en-us/download/details.aspx?id=50034

Accepted answer

Vicky Wang 2,736 Reputation points

2021-06-07T09:44:14.587+00:00

Hi,
Thank you for your patience and reply.
If the information provided by me and the MVP is not helpful to you. I might suggest that you go to Microsoft to open a consulting case.
A senior engineer may be able to give you a more comprehensive suggestion.
reference: https://support.microsoft.com/en-in/hub/4343728/support-for-business
Hope this information can help you
Best wishes
Vicky
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

7 additional answers

Anonymous

2021-06-04T02:28:29.747+00:00

I'm not aware of any recent tools. The event log source and event IDs are ever changing as well.

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
James Ward-Smith 21 Reputation points

2021-06-04T02:59:32.957+00:00

Is it possible to use this approach:

Navigate to HKLM\SYSTEM\CCS\Services\Eventlog key; it contains the various services and drivers that are able to generate events. At a minimum, they include a EventMessageFile value that points to the source(s) of the events (e.g., C:\WINDOWS\System32\Ati2evxx.exe ⇐ non-Microsoft), and a TypesSupported value which defines what type of events it supports. Knowing the EventMessageFile should be enough to do brute-force detect all supported values

Can you reverse engineer the .dll file or .exe file to discover all the Event ID values?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Vicky Wang 2,736 Reputation points

2021-06-04T09:20:18.39+00:00

Hi，
Thank you for posting in our forum:

You just want to know all the errors, do you? If so, then the link below may be helpful to you

https://adamtheautomator.com/windows-security-events/

https://superuser.com/questions/394422/list-of-all-windows-7-event-ids-and-sources

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

Thank you for your understanding and support

Best wishes

Vicky
Please sign in to rate this answer.
James Ward-Smith 21 Reputation points

2021-06-05T01:46:22.277+00:00

Hi Vicky,

Thank you for sharing those resources, however they do not list every possible Windows Event ID. They only list the Windows Event ID's from the Security "category:.

Kind regards,

James
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Vicky Wang 2,736 Reputation points

2021-06-07T07:17:35.22+00:00

Hi,
Just checking in to see if the information provided was helpful.
Please let us know if you would like further assistance.
Best Regards,
Vicky
Please sign in to rate this answer.
James Ward-Smith 21 Reputation points

2021-06-07T07:22:47.29+00:00

Hi Vicky,

Nope, I haven’t really been able to progress on this. I cannot find an entire listing of Windows Event ID’s anywhere. I thought Microsoft surely have this information somewhere?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

List every possible Windows Event ID

7 additional answers

Your answer