https://win.shenlijun.cn/Recent content on EventIDHugoen-USFri, 23 Oct 2026 12:00:00 +0800https://win.shenlijun.cn/tools/powershell-event-log-query-builder/Fri, 23 Oct 2026 12:00:00 +0800https://win.shenlijun.cn/tools/powershell-event-log-query-builder/<h2 id="why-not-just-open-event-viewer">Why not just open Event Viewer</h2> <p>Filtering in the GUI is fine for one event. The moment you need to compare a week of 4625s, or hand the query to a colleague, a command is faster and repeatable.</p>https://win.shenlijun.cn/events/event-id-7031-service-terminated-unexpectedly/Fri, 23 Oct 2026 11:00:00 +0800https://win.shenlijun.cn/events/event-id-7031-service-terminated-unexpectedly/<h2 id="what-you-see">What you see</h2> <p>System log shows 7031, sometimes followed by 7034 (terminated unexpectedly, no recovery) or 7000/7009 (failed to start). Users notice the feature before you notice the log.</p> <h2 id="why-it-happens">Why it happens</h2> <p>7031 is the Service Control Manager reporting a death it did not order. The service process exited or was killed:</p>https://win.shenlijun.cn/events/event-id-4740-account-locked-out/Fri, 23 Oct 2026 10:00:00 +0800https://win.shenlijun.cn/events/event-id-4740-account-locked-out/<h2 id="what-you-see">What you see</h2> <p>The user cannot sign in, and the helpdesk unlocks the account. Ten minutes later it locks again. The Security log on the domain controller shows 4740 with the same <code>Caller Computer Name</code> each time.</p>https://win.shenlijun.cn/events/event-id-4625-failed-logon/Fri, 23 Oct 2026 09:00:00 +0800https://win.shenlijun.cn/events/event-id-4625-failed-logon/<h2 id="what-you-see">What you see</h2> <p>The Security log fills with 4625 events. Each one records a failed logon, but not every 4625 is an attack — service accounts with stale passwords produce them continuously.</p>