How to Export Windows Event Logs (EVTX)

The short answer: open Event Viewer, right-click the log you need (for example Windows Logs → Security), choose Save All Events As…, and keep the .evtx format. From an elevated command prompt, the same thing is one line: wevtutil epl Security C:\logs\security.evtx. Don’t copy the files out of C:\Windows\System32\winevt\Logs with Explorer. The Event Log service keeps them open, so you usually get an error or nothing usable.

EVTX is worth the extra minute compared with a text export. It’s the native format, so every field, the record IDs and the exact UTC timestamps survive. A SIEM can’t give you that back, because it stores rendered text. Prime Core has 11,632 sigma rules for Windows event logs, mapped to 643 MITRE ATT&CK techniques. They range from password guessing (T1110) and malicious services (T1543.003) to attackers clearing the logs behind them (T1070.001). Below is how to export the right logs, sanitize them, and investigate them for free in LogTotal.

Try LogTotal, free

TL;DR

Route	Use it when	What you need
Event Viewer → Save All Events As	One machine, one or two logs, you have a desktop session	Admin rights, or Event Log Readers for most logs
wevtutil epl	You want a filtered export, a script, or a server without a GUI	An elevated prompt
wevtutil with /r: or a PowerShell loop	Several logs, or a remote machine	Admin rights on the target, plus remote event log access through the firewall

Before you start

Three things decide whether the export contains what you hope it contains.

Rights. Administrators can export any log. Members of the local Event Log Readers group can read most logs without full admin. For the Security log, an elevated prompt is the dependable choice. Details are in our [Windows event log permissions guide].

Audit policy. Windows only logs what it’s told to. Process creation (event 4688) isn’t audited by default. Even when it is, the command line is recorded only if a separate policy is enabled. Check before you go looking for events that were never written:

auditpol /get /category:*

Log size and overwrite. Every log has a maximum size. By default, Windows overwrites the oldest events once the log is full, and on a busy server or domain controller that can mean only hours of history. See what you’re working with:

wevtutil gl Security

Look at maxSize and retention. If the attack happened before the oldest event in the log, it isn’t in there. Check your SIEM or forwarded events instead.

And the usual reminder: event logs are full of usernames, hostnames and IPs. LogTotal sanitizes uploads, but your data-handling policy still applies.

Which logs to export

“The Windows logs” is a few hundred channels on a modern system. For security work, these are the ones that usually carry the story:

Log (channel name)	What it gives you	Notes
Security	Logons (4624, 4625), account changes (4720, 4728), log cleared (1102), process creation (4688)	4688 only if auditing is on
System	New services (7045), service changes (7036), System log cleared (104)
Microsoft-Windows-Sysmon/Operational	Process creation with hashes and command lines, network connections, and more	Only if Sysmon is installed
Microsoft-Windows-PowerShell/Operational	Script block logging (4104), the actual code that ran	Only if script block logging is enabled
Microsoft-Windows-Windows Defender/Operational	Detections (1116) and actions taken (1117)
Microsoft-Windows-TaskScheduler/Operational	New scheduled tasks (106), a favorite persistence trick
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	RDP session logon, disconnect, reconnect (21, 24, 25)

Not sure what a machine has? wevtutil el lists every channel. Pipe it through findstr /i sysmon (or whatever you’re hunting for) to check a specific one.

Option 1: Event Viewer

Best for one machine and a couple of logs.

1. Press Win+R, type eventvwr.msc, and run it as administrator.
2. Find the log. The classic ones are under Windows Logs. Everything else lives under Applications and Services Logs → Microsoft → Windows. Sysmon, for example, is at …\Windows\Sysmon\Operational.
3. Right-click the log and choose Save All Events As…
4. Keep Event Files (*.evtx) as the type and give the file a name that says what it is, like dc-01_security_2026-10-20.evtx.
5. Windows then asks about display information. That decides whether a LocaleMetaData folder with message text gets saved next to the file, which helps when someone opens it in Event Viewer on another machine. For a LogTotal upload, the .evtx file is what counts.

Need only part of the log? Use Filter Current Log… first (event IDs, time range), then Save Filtered Log File As…. The XML tab of that filter dialog shows the exact XPath query it built. Copy it; you’ll want it for wevtutil in a minute.

Option 2: wevtutil from the command line

wevtutil ships with every Windows version you’re likely to meet. It works without a GUI and can filter while it exports. Run it from an elevated prompt.

The whole log:

mkdir C:\logs
wevtutil epl Security C:\logs\dc-01_security.evtx

Only the last 24 hours (the number is milliseconds):

wevtutil epl Security C:\logs\dc-01_security_24h.evtx /q:”*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]”

An exact window, in UTC:

wevtutil epl Security C:\logs\dc-01_security_1019.evtx /q:”*[System[TimeCreated[@SystemTime>=’2026-10-19T00:00:00.000Z’ and @SystemTime<‘2026-10-20T00:00:00.000Z’]]]”

Only logons, successful and failed:

wevtutil epl Security C:\logs\dc-01_logons.evtx /q:”*[System[(EventID=4624 or EventID=4625)]]”

Channel names with spaces need quotes:

wevtutil epl “Microsoft-Windows-Windows Defender/Operational” C:\logs\defender.evtx

If the target file already exists, wevtutil refuses to overwrite it unless you add /ow:true. Writing XPath by hand gets old quickly. Build the filter in Event Viewer and copy the query from the XML tab, as described above.

On a domain controller, filter. An unfiltered Security export from a busy DC can run to gigabytes, and you’ll be uploading most of it for nothing.

Option 3: Several logs, or a remote machine

For triage, you usually want the same handful of logs from every host. This PowerShell snippet exports them into one folder per machine and skips any channel that doesn’t exist (no Sysmon, for example) instead of failing:

$out = “C:\logs\$env:COMPUTERNAME”
New-Item -ItemType Directory -Force -Path $out | Out-Null

$logs = ‘Security’, ‘System’,
        ‘Microsoft-Windows-Sysmon/Operational’,
        ‘Microsoft-Windows-PowerShell/Operational’,
        ‘Microsoft-Windows-Windows Defender/Operational’,
        ‘Microsoft-Windows-TaskScheduler/Operational’

foreach ($l in $logs) {
    $file = Join-Path $out (($l -replace ‘[\\/ ]’, ‘_’) + ‘.evtx’)
    wevtutil epl $l $file /ow:true 2>$null
    if ($LASTEXITCODE -ne 0) { Write-Warning “Skipped: $l” }
}

Remote machines. wevtutil accepts /r:<computer>, but there’s a catch people find the hard way: the export file is written on the remote machine’s disk, not yours. Plan to fetch it afterwards:

wevtutil epl Security C:\logs\srv-01_security.evtx /r:srv-01
copy \\srv-01\C$\logs\srv-01_security.evtx .

That needs admin rights on the target and the Remote Event Log Management firewall rules enabled there. If those rules are off and you’d rather not touch them, PowerShell remoting does the same job: run the snippet above through Invoke-Command, then pull the files back with Copy-Item -FromSession.

Upload and review in LogTotal

LogTotal reads EVTX natively, so there’s nothing to convert. It’s SOC Prime’s free service for running detection logic against a log file without setting anything up. 

1. Upload. Open logtotal.com and drop in the .evtx file. [PROOF: upload screen, size limit, whether several files can go in at once]
2. Review. [PROOF: what the results screen shows and how findings map to rules and ATT&CK techniques]

What this looks like on real data. We used [PROOF: sample source, e.g. a Security.evtx from a throwaway Windows VM after a simulated attack chain: failed logons, a new local admin, a new service, then the Application log being cleared]. The file was [PROOF: N events, X MB]. LogTotal flagged [PROOF: actual findings, matched rules, ATT&CK techniques].

Want to try it first? [PROOF: link to the sample file] is the same file we used above.

When it goes wrong

Symptom	Likely cause	Fix
Access is denied	Prompt isn’t elevated, or the account lacks rights to that log	Run as administrator
The specified channel could not be found	Typo in the channel name, or the component isn’t installed (Sysmon is the usual one)	Check with wevtutil el | findstr /i <name>
wevtutil complains that the file exists	It doesn’t overwrite by default	Add /ow:true, or pick a new file name
The specified query is invalid	XPath quoting or syntax	Build the filter in Event Viewer and copy it from the XML tab
Copying from winevt\Logs fails with “in use by another process”	The Event Log service holds the live files open	Export with Event Viewer or wevtutil instead
No 4625 or 4688 events at all	That category isn’t audited	Check auditpol /get /category:*; this fixes future events, not past ones
The log only goes back a few hours	Log is full and overwriting	Check wevtutil gl Security; look for Archive-Security-*.evtx files if archiving is on
The RPC server is unavailable with /r:	Remote Event Log Management firewall rules are off	Enable them on the target, or use PowerShell remoting
Remote export “succeeded,” but there’s no file	/r: writes the file on the remote machine	Look on the target’s disk, e.g. \\srv-01\C$\logs