Monitor Windows Event Logs Automatically with PowerShell

In partnership with

THE PROBLEM

Your servers are constantly writing warnings and errors to the Event Log — but nobody's reading them until something breaks. By then it's too late. This week we build a script that watches your Event Logs 24/7 and emails you the moment a critical error appears. No more flying blind.

THE SCRIPT

Open Notepad, paste the script below, and save it to:

C:\Scripts\EventLogMonitor.ps1

PowerShell

# Windows Event Log Monitor & Alert System
# Automate & Operate — automateandoperate.com

# Settings — update these
$from = "[email protected]"
$to = "[email protected]"
$smtpServer = "smtp.gmail.com"
$smtpPort = 587
$username = "[email protected]"
$password = ConvertTo-SecureString "yourpassword" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($username, $password)
$logFile = "C:\Logs\EventLogMonitor.log"

# How far back to check (in minutes)
$checkIntervalMinutes = 60

# Event logs and levels to monitor
$logsToCheck = @("System", "Application")
$levelToCheck = @(1, 2)  # 1 = Critical, 2 = Error

# Create log folder if missing
if (-not (Test-Path "C:\Logs")) {
    New-Item -ItemType Directory -Path "C:\Logs"
}

$startTime = (Get-Date).AddMinutes(-$checkIntervalMinutes)
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

foreach ($logName in $logsToCheck) {
    try {
        $events = Get-WinEvent -FilterHashtable @{
            LogName   = $logName
            Level     = $levelToCheck
            StartTime = $startTime
        } -ErrorAction SilentlyContinue

        if ($events -and $events.Count -gt 0) {
            $eventSummary = $events | Select-Object -First 10 | ForEach-Object {
                "[$($_.TimeCreated)] [$($_.LevelDisplayName)] Source: $($_.ProviderName)`nMessage: $($_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)))`n"
            }

            $body = "Critical/Error events detected in $logName log on $env:COMPUTERNAME`n`n"
            $body += $eventSummary -join "`n---`n"
            $body += "`n`nAutomate & Operate — automateandoperate.com"

            Send-MailMessage `
                -From $from -To $to `
                -Subject "EVENT ALERT: $($events.Count) error(s) in $logName log on $env:COMPUTERNAME" `
                -Body $body `
                -SmtpServer $smtpServer -Port $smtpPort `
                -UseSsl -Credential $credential

            Add-Content -Path $logFile -Value "$timestamp — ALERT SENT: $($events.Count) events found in $logName"
        } else {
            Add-Content -Path $logFile -Value "$timestamp — OK: No critical events in $logName"
        }
    } catch {
        Add-Content -Path $logFile -Value "$timestamp — ERROR checking $logName — $_"
    }
}

Update these lines with your details:

$from — your Gmail address
$to — where alerts should go
$password — your Gmail password or app password
$checkIntervalMinutes — how far back to look each run (match this to your Task Scheduler interval)

SETTING UP TASK SCHEDULER

Press Windows key → type Task Scheduler → open it
Click "Create Basic Task" in the right panel
Name it: Event Log Monitor → click Next
Trigger: Daily → click Next
Start time: 6:00am → click Next
Action: "Start a program" → click Next
Program: powershell.exe
Arguments:

-ExecutionPolicy Bypass -File "C:\Scripts\EventLogMonitor.ps1"

Click Next → Finish

Set it to repeat every 60 minutes:

Right click Event Log Monitor → Properties
Click Triggers tab → Edit
Check "Repeat task every" → set to 1 hour
Duration: Indefinitely
Click OK → OK

TEST IT

Open PowerShell as administrator and run:

powershell

powershell.exe -ExecutionPolicy Bypass -File "C:\Scripts\EventLogMonitor.ps1"

Check C:\Logs\EventLogMonitor.log to confirm it ran. To force a test alert temporarily change $checkIntervalMinutes = 525600 — this looks back a full year and will almost certainly find errors to alert on.

WHY THIS MATTERS

Most outages don't happen without warning — the Event Log was screaming for hours before the crash. This script turns those silent warnings into immediate email alerts so you can act before users are affected. Set it up on every server in your environment and you'll catch issues you never knew existed.

THIS WEEK'S ACTION

Deploy this on your most critical server today. Let it run for 48 hours and review what comes in. You'll likely discover errors that have been happening for weeks without anyone knowing.

Reply to this email if you hit any issues — I read every reply.

Automate & Operate — automateandoperate.com

The ones showing up in LLMs convert 3× better than Google

They optimized for LLMs, not just Google.

FAQs. Comparison pages. Transparent pricing. LinkedIn presence. These aren't vanity plays. They're what gets you cited in ChatGPT, Gemini, and Claude when your buyers are researching, your investors are looking, and your future hires are deciding where to work.

Download the free AEO Playbook for Startups from HubSpot and get the exact checklist. Five minutes to read.

Unlock the playbook

Your next 100 customers are already in Apollo

Find, reach, and close your perfect deals — without juggling five tools or hiring more reps.

Apollo gives you everything you need to build real pipeline, fast. From inbound to outbound, first touch to close.

All in Apollo.

Stop Flying Blind — Monitor Windows Event Logs Automatically

The ones showing up in LLMs convert 3× better than Google

Your next 100 customers are already in Apollo

Keep Reading

Automate & Operate