Tip of the Day: Windows PowerShell cleans up Events


Today’s Tip…

We, as support staff, are constantly opening customer event logs and this could lead to a situation as following:

image

(Event log names removed for privacy reasons)

In the past you had to right click each entry and click onto remove. Now this can be accomplished by 3 simple steps:

  1. Close event viewer
  2. Run the following powershell commands in an elevated powershell:

$SavedEventlogs=get-childitem 'C:\ProgramData\Microsoft\Event Viewer\ExternalLogs'

ForEach ($eventlog in $Savedeventlogs) {

remove-item $eventlog.FullName}

  1. Start event viewer and all saved logs should be gone.


Comments (1)

  1. Addon to this "PowerShell" tip:
    – replace C:ProgramData with $env:ProgramData
    – if you created subfolders, you should use -recurse
    – if you untick "for all users", you need to clean up $env:LocalAppDataMicrosoftEvent ViewerExternalLogs
    To do this even faster, simply remove the whole folders:
    ( get-item "$env:programdataMicrosoftEvent ViewerExternalLogs" ).Delete( $True )
    ( get-item "$env:LocalAppDataMicrosoftEvent ViewerExternalLogs" ).Delete( $True )
    Event Viewer will happily recreate them if required.

Skip to main content