Windows Events — Event ID Reference & Troubleshooting

Windows Event ID 258 – System: Process Termination with Exit Code

Event ID 258 indicates a process has terminated with a specific exit code, often signaling application crashes, forced terminations, or abnormal process endings that require investigation.

Windows Event ID 256 – Unknown: Generic Application or System Error Event

Event ID 256 represents a generic error condition from an unspecified source, often indicating application crashes, service failures, or system component issues requiring detailed investigation.

Windows Event ID 105 – Microsoft-Windows-Kernel-Power: System Power State Transition

Event ID 105 from Microsoft-Windows-Kernel-Power indicates system power state transitions, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for power management troubleshooting.

Windows Event ID 102 – Microsoft-Windows-Kernel-Power: System Power State Transition

Event ID 102 indicates a system power state transition, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for diagnosing power management issues.

Windows Event ID 63 – Service Control Manager: Service Start Pending Timeout

Event ID 63 indicates a Windows service failed to start within the configured timeout period. This critical event helps identify service startup issues and potential system performance problems.

Windows Event ID 45 – Kernel-Power: System Power State Transition

Event ID 45 from Kernel-Power indicates a system power state transition, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for power management troubleshooting.

Windows Event ID 32 – EventLog: File System Redirector

Event ID 32 indicates the File System Redirector has started successfully. This informational event confirms that Windows file system redirection services are operational and ready to handle file system requests.

Windows Event ID 31 – System: Service Control Manager Timeout

Event ID 31 indicates a service failed to respond to a start or control request within the timeout period, typically 30 seconds, causing the Service Control Manager to log this warning.

Windows Event ID 30 – Kernel-Power: System Power State Transition

Event ID 30 from Kernel-Power indicates a system power state transition, typically recording when Windows enters or exits sleep, hibernation, or other power management states.

Windows Event ID 27 – Application Error: Application Hang Detection

Event ID 27 indicates Windows has detected an application hang or unresponsive state. This event fires when applications stop responding to user input or system messages for extended periods.

Windows Event ID 26 – Application Popup: System Process Terminated Unexpectedly

Event ID 26 indicates a critical system process has terminated unexpectedly, triggering Windows Error Reporting. This event typically signals serious system instability requiring immediate investigation.

Windows Event ID 24 – Application Error: Application Hang Detection

Event ID 24 indicates Windows has detected an application hang or unresponsive state. This event fires when applications stop responding to user input or system messages for extended periods.

Windows Event ID 23 – Application Error: Application Hang Detection

Event ID 23 indicates Windows has detected an application hang condition where a program becomes unresponsive and fails to process messages within the timeout threshold.

Windows Event ID 17 – WHEA-Logger: Hardware Error Architecture Corrected Error

Event ID 17 from WHEA-Logger indicates Windows Hardware Error Architecture detected and corrected a hardware error. This informational event helps track system stability and potential hardware degradation.

Windows Event ID 15 – Kernel-General: System Time Changed

Event ID 15 from Kernel-General logs when the system time is changed, either manually by users, automatically by time synchronization services, or due to hardware clock adjustments.

Windows Event ID 5 – Kernel: Process Terminated Unexpectedly

Event ID 5 indicates a critical process or service has terminated unexpectedly, often due to access violations, memory corruption, or system instability requiring immediate investigation.

Windows Event ID 4 – Kernel-General: System Process Terminated Unexpectedly

Event ID 4 indicates a critical system process has terminated unexpectedly, often signaling kernel-level failures, driver issues, or system instability requiring immediate investigation.

Windows Event ID 3 – System: Network Connection Established

Event ID 3 indicates a successful network connection has been established by the Windows system, typically logged when network services start or connections are made to remote resources.

Windows Event ID 2 – Kernel-General: System Boot Completion

Event ID 2 from Kernel-General indicates successful Windows system boot completion. This informational event logs when the kernel finishes loading and the system is ready for user logon.

Windows Event ID 0 – Unknown: System Event with Undefined Source

Event ID 0 with Unknown source indicates a system event where the event source could not be properly identified or registered, often pointing to corrupted event log entries or missing event source definitions.

Windows Event ID 19 – Kernel-PnP: Device Installation or Configuration Event

Event ID 19 from Kernel-PnP indicates Plug and Play device installation, configuration changes, or driver-related activities on Windows systems.