HardwareEvents.evtx log is unavailable in Nano Server

Applies to: Windows Server 2016


By default in Windows Server 2016 Nano Server, the HardwareEvents.evtx log is unavailable.


To enable the HardwareEvents.evtx log in Nano Server, follow these steps:
  1. Log on remotely to Nano Server, as described on the "Manage Nano Server" page of the Nano Server documentation at http://aka.ms/nanoserver:

    $ip = "<IP address of Nano Server>"
    Set-Item WSMan:\localhost\Client\TrustedHosts $ip
    Enter-PSSession -ComputerName $ip -Credential "$ip\Administrator"
  2. In the PSSession that you entered in step 1, navigate to the C:\Windows\System32\winevt\Logs directory. A directory listing at this location displays the available logs. Notice that HardwareEvents.evtx is not listed when you search for it as follows:

    Set-Location C:\Windows\System32\winevt\Logs

  3. Run the following PowerShell command to create the registry key for the HardwareEvents log:

    New-Item -Path HKLM:\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents
  4. Run the following command to verify that HardwareEvents.evtx is now available in the C:\Windows\System32\winevt\Logs directory:

    Get-ChildItem C:\Windows\System32\winevt\Logs