Windows Event ID 3 – System: Network Connection Established

Open Event Viewer to examine the specific details of Event ID 3 entries and understand what network activity triggered the event.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 3 in the Event IDs field and click OK
5. Double-click any Event ID 3 entry to view detailed information
6. Review the General tab for event description and timestamp
7. Check the Details tab for technical parameters and source information
8. Note the Event Source and Task Category to identify the specific network component

Leverage PowerShell to query and analyze Event ID 3 patterns, frequency, and correlation with other network events.

1. Open PowerShell as Administrator
2. Query recent Event ID 3 entries with timestamps:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=3} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. Analyze event frequency over the last 24 hours:

   $Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=3; StartTime=(Get-Date).AddDays(-1)}
   $Events | Group-Object {$_.TimeCreated.Hour} | Select-Object Name, Count | Sort-Object Name

4. Search for specific network service patterns:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=3} | Where-Object {$_.Message -like '*DNS*' -or $_.Message -like '*DHCP*'} | Select-Object TimeCreated, Message

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=3} -MaxEvents 100 | Export-Csv -Path C:\Temp\EventID3_Analysis.csv -NoTypeInformation

Verify that Event ID 3 entries correspond to actual network service operations and identify any missing expected connections.

1. Check network service status using Services console:

   Get-Service | Where-Object {$_.Name -like '*DNS*' -or $_.Name -like '*DHCP*' -or $_.Name -like '*Workstation*'} | Select-Object Name, Status, StartType

2. Verify network adapter status and configuration:

   Get-NetAdapter | Select-Object Name, InterfaceDescription, Status, LinkSpeed

3. Check IP configuration and connectivity:

   Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer

4. Test network connectivity to critical services:

   Test-NetConnection -ComputerName "domain.local" -Port 389
   Test-NetConnection -ComputerName "8.8.8.8" -Port 53

5. Review Windows Firewall logs for connection attempts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 20 | Select-Object TimeCreated, Message

Use Performance Monitor and PowerShell to correlate Event ID 3 timing with actual network performance metrics.

1. Open Performance Monitor by running perfmon.msc
2. Add network-related performance counters:
   • Network Interface → Bytes Total/sec
   • Network Interface → Packets/sec
   • TCPv4 → Connections Established
3. Create a PowerShell script to monitor network connections:

   while ($true) {
       $timestamp = Get-Date
       $connections = Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | Measure-Object
       Write-Host "$timestamp - Active TCP Connections: $($connections.Count)"
       Start-Sleep -Seconds 30
   }

4. Check network utilization patterns:

   Get-Counter "\Network Interface(*)\Bytes Total/sec" -SampleInterval 5 -MaxSamples 12

5. Correlate high network activity with Event ID 3 timestamps to identify connection patterns

Investigate registry settings and Group Policy configurations that might affect network service behavior and Event ID 3 generation.

1. Examine network service registry settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" | Select-Object EnableDHCP, Domain, SearchList

2. Check DNS client configuration:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"

3. Review network-related Group Policy settings:

   gpresult /h C:\Temp\GPResult.html
   # Review the HTML report for network and security policies

4. Examine Event Log service configuration:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\System" | Select-Object MaxSize, Retention

5. Check network provider order in registry:HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
6. Verify Windows Firewall domain profile settings:

   Get-NetFirewallProfile -Profile Domain | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction