[{"title":"PowerShell Event Log Query Builder","url":"/tools/powershell-event-log-query-builder/","text":"PowerShell Event Log Query Builder Why not just open Event Viewer Filtering in the GUI is fine for one event. The moment you need to compare a week of 4625s, or hand the query to a colleague, a command is faster and repeatable.\nFilterHashtable or XML Get-WinEvent -FilterHashtable is readable and covers the common cases: log name, event ID, level, provider, time window. It cannot express every condition.\n-FilterXml accepts the full event query language, including and/or combinations that the hashtable cannot express. The builder emits both.\nTwo gotchas Time is in UTC in the XML, local in the hashtable. StartTime=(Get-Date).AddHours(-24) uses local time. timediff(@SystemTime) in the XML query is relative, so it behaves the same.\nSecurity log needs elevation. Reading Security requires an administrator token; otherwise Get-WinEvent returns access denied and the event looks missing.\nRelated Event ID 4625: An account failed to log on Event ID 4740: A user account was locked out "},{"title":"Event ID 7031: Service terminated unexpectedly","url":"/events/event-id-7031-service-terminated-unexpectedly/","text":"Event ID 7031: Service terminated unexpectedly What you see System log shows 7031, sometimes followed by 7034 (terminated unexpectedly, no recovery) or 7000/7009 (failed to start). Users notice the feature before you notice the log.\nWhy it happens 7031 is the Service Control Manager reporting a death it did not order. The service process exited or was killed:\nan unhandled exception in the service the process hit a memory limit or was killed by a resource policy a dependency (database, network share, license server) disappeared a bad update replaced a DLL the service loads the service account password expired and the process could not reauthenticate Fix 1. Get the crash detail from the Application log.\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Application\u0026#39;; ProviderName=\u0026#39;Application Error\u0026#39;; StartTime=(Get-Date).AddDays(-2)} | Select-Object TimeCreated, Id, Message -First 10 An Application Error or .NET Runtime event within a second of the 7031 gives you the faulting module. That name is the lead, not the service name.\n2. Check for 7034 and 7000 as well.\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;System\u0026#39;; Id=7031,7034,7000,7009; StartTime=(Get-Date).AddDays(-7)} | Group-Object Id | Select-Object Name, Count 3. Confirm the service account is still valid.\nGet-CimInstance Win32_Service -Filter \u0026#34;Name=\u0026#39;Spooler\u0026#39;\u0026#34; | Select-Object Name, StartName, State, ExitCode If StartName is a domain account, check its password expiry and lockout state.\n4. Check dependencies before blaming the service.\nGet-Service Spooler | Select-Object -ExpandProperty ServicesDependedOn 5. Add recovery actions so a single crash does not page anyone.\nsc failure Spooler reset= 86400 actions= restart/60000/restart/60000/restart/60000 That restarts after 60 seconds, three times, then resets the counter daily. This buys time; it is not a fix.\n6. If it crashes repeatedly after an update, roll the update back.\nGet-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 Correlate the first 7031 timestamp with the install time before you uninstall anything.\n7. Capture a dump for the vendor.\nNew-Item -ItemType Directory -Force C:\\dumps reg add \u0026#34;HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\spoolsv.exe\u0026#34; /v DumpFolder /t REG_EXPAND_SZ /d C:\\dumps /f reg add \u0026#34;HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\spoolsv.exe\u0026#34; /v DumpType /t REG_DWORD /d 2 /f The next crash writes a full dump you can hand to support.\nVerify Get-WinEvent -FilterHashtable @{LogName=\u0026#39;System\u0026#39;; Id=7031; StartTime=(Get-Date).AddHours(-24)} No new events over a normal business day, and the service state stays Running.\nRelated Event ID 4625: An account failed to log on PowerShell Event Log Query Builder "},{"title":"Event ID 4740: A user account was locked out","url":"/events/event-id-4740-account-locked-out/","text":"Event ID 4740: A user account was locked out What you see The user cannot sign in, and the helpdesk unlocks the account. Ten minutes later it locks again. The Security log on the domain controller shows 4740 with the same Caller Computer Name each time.\nWhy it happens An account locks after the number of bad passwords set in the domain lockout policy. Something on the network keeps presenting an old password:\na mapped drive or Outlook profile with saved credentials a Windows service or scheduled task running as that user a mobile device with a stale Exchange or VPN password an RDP session reconnecting with cached credentials a script or application hard-coding the password Fix 1. Read the caller computer.\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Security\u0026#39;; Id=4740; StartTime=(Get-Date).AddHours(-24)} | ForEach-Object { $x = [xml]$_.ToXml() [pscustomobject]@{ Time = $_.TimeCreated Account= $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;TargetUserName\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; Caller = $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;TargetDomainName\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; } } In the event text, Caller Computer Name is the machine to investigate. If it shows the DC itself, the source is a service or scheduled task on the DC.\n2. On the caller machine, find the process using the account.\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Security\u0026#39;; Id=4625; StartTime=(Get-Date).AddHours(-2)} | Where-Object { $_.Message -match \u0026#39;jsmith\u0026#39; } | Select-Object TimeCreated, @{n=\u0026#39;Type\u0026#39;;e={($_.Message -split \u0026#34;`n\u0026#34; | Select-String \u0026#39;Logon Type\u0026#39;) -replace \u0026#39;.*:\\s*\u0026#39;,\u0026#39;\u0026#39;}} A Logon Type 3 points at SMB or a mapped drive, 4 at Task Scheduler, 5 at a service, 10 at RDP.\n3. Clear the cached credential.\nOn the user\u0026rsquo;s workstation:\ncontrol keymgr.dll Remove entries for the file server or mail server. Then sign out and back in — a locked Windows session keeps the old token.\n4. Fix services and scheduled tasks.\nGet-CimInstance Win32_Service | Where-Object { $_.StartName -like \u0026#39;*jsmith*\u0026#39; } | Select-Object Name, StartName, State Get-ScheduledTask | Where-Object { $_.Principal.UserId -like \u0026#39;*jsmith*\u0026#39; } | Select-Object TaskPath, TaskName Update the stored password with sc.exe config \u0026lt;service\u0026gt; password= \u0026lt;new\u0026gt; or in Task Scheduler.\n5. Check mobile devices.\nOld ActiveSync or VPN clients retry indefinitely. Review Get-MobileDeviceStatistics in Exchange or the VPN concentrator logs.\n6. Only then unlock.\nUnlock-ADAccount -Identity jsmith Or net user jsmith /domain /active:yes.\nVerify Watch the DC for 30 minutes after the fix:\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Security\u0026#39;; Id=4740; StartTime=(Get-Date).AddMinutes(-30)} No new events means the stale credential is gone.\nRelated Event ID 4625: An account failed to log on PowerShell Event Log Query Builder "},{"title":"Event ID 4625: An account failed to log on","url":"/events/event-id-4625-failed-logon/","text":"Event ID 4625: An account failed to log on What you see The Security log fills with 4625 events. Each one records a failed logon, but not every 4625 is an attack — service accounts with stale passwords produce them continuously.\nRead these three fields first Logon Type tells you where the attempt came from:\nType Meaning 2 Interactive, at the console 3 Network, SMB or a mapped drive 4 Batch, scheduled task 5 Service 7 Unlock 10 Remote Desktop Sub Status tells you why it failed:\nSub Status Meaning 0xC000006A Wrong password 0xC0000064 Account does not exist 0xC0000234 Account is locked out 0xC0000072 Account is disabled 0xC0000071 Password expired 0xC000006F Outside allowed logon hours 0xC0000133 Clock skew between client and DC 0xC000015B Logon type not granted to this account Workstation Name / Source Network Address tells you which machine is retrying.\nFix 1. Pull the failures with the useful fields only.\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Security\u0026#39;; Id=4625; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 200 | ForEach-Object { $x = [xml]$_.ToXml() [pscustomobject]@{ Time = $_.TimeCreated Account = $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;TargetUserName\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; Type = $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;LogonType\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; SubStatus= $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;SubStatus\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; Source = $x.Event.EventData.Data | Where-Object Name -eq \u0026#39;IpAddress\u0026#39; | ForEach-Object \u0026#39;#text\u0026#39; } } | Group-Object Account, SubStatus | Sort-Object Count -Descending 2. Match the failure to its cause.\nWrong password on type 3, every few minutes, from one host: a mapped drive or saved credential with an old password Wrong password on type 5: a service account whose password was changed in AD but not in the service configuration 0xC0000234: the account is already locked, see Event ID 4740 0xC0000133: fix time sync, w32tm /resync on the client 3. Clear stale credentials on the source machine.\ncontrol keymgr.dll Remove entries for the server, then reconnect.\n4. If the source is unknown or external, treat it as hostile.\nCheck the firewall for exposed RDP or SMB, and review 4625 volume by source IP. Repeated 0xC000006A from one address is password guessing, not a broken client.\nVerify After fixing the source, filter again and confirm no new 4625 for that account:\nGet-WinEvent -FilterHashtable @{LogName=\u0026#39;Security\u0026#39;; Id=4625; StartTime=(Get-Date).AddMinutes(-15)} | Where-Object { $_.Message -match \u0026#39;jsmith\u0026#39; } Related Event ID 4740: A user account was locked out PowerShell Event Log Query Builder "}]