Forum Discussion

satishsalunkhe007's avatar
satishsalunkhe007
Copper Contributor
Jun 20, 2022

List every possible Windows Event ID

Hello Techs,

I am currently trying to discover a way to get a listing of every possible Windows Event ID and associated description?

 

I am interested in a listing of every POSSIBLE Windows Event ID for below in Event Viewer for alerting.
- Hyper-V
- Azure
- Hyper-V replication
- Window Failover Cluster
- Windows Network

 

I mean, Where i can get all event id relates to above roles. I got URL (KB.eventtracker.com) but that is not much helpful.

Do you recommend any website or any blogs where i can find all window event id under one central location.

 

Your assistance would be highly appreciated.

 

Thank you,

Satish

azure

1 Reply

  • bounjee's avatar
    bounjee
    Copper Contributor
    Dec 15, 2025

    Hi, there isn’t a single official “master list of every possible Windows Event ID” because Event IDs are defined per event provider (publisher) and depend on what roles/features/agents are installed (Hyper-V, Failover Clustering, specific Azure agents, etc.). A practical way is to enumerate providers and export the provider metadata on a machine that has those roles enabled.

    Option 1 (built-in): wevtutil

    List all publishers and filter by keywords (Hyper-V / Failover / Clustering / Network):

    wevtutil ep | findstr /i "Hyper-V Failover Cluster Clustering Network"


    For each relevant provider, export event metadata (this includes the event IDs that provider can raise):

    wevtutil gp "Microsoft-Windows-Eventlog" /ge:true /f:xml


    (Replace the provider name with the ones you found; you can also add /gm:true to show resolved messages where available.)

    Microsoft docs for wevtutil (including ep and gp /ge:true) are here: 
    Microsoft Learn

    Option 2 (PowerShell): Get-WinEvent provider metadata
    You can also pull provider event IDs via:

    Get-WinEvent -ListProvider "<ProviderName>" and read the .Events list (Id + Description) for each provider.

    Note on “Azure”: “Azure” event IDs vary a lot depending on what you mean (Azure Arc, Azure Monitor Agent, Azure Stack HCI/Azure Local, etc.). If you share which Azure component/agent you’re using, you can narrow the exact providers/log channels.

    The original question here mentions Hyper-V / replication / Failover Cluster / Network, so I’d start by exporting all Microsoft-Windows-Hyper-V-* and Microsoft-Windows-FailoverClustering* providers from a host where those roles are installed. 

     

    — H. John | https://www.hadsiz.com/ — a community/forum project I’m building

Resources