By default in Windows Server 2016 Nano Server, the HardwareEvents.evtx log is unavailable.
To enable the HardwareEvents.evtx log in Nano Server, follow these steps:
- Log on remotely to Nano Server, as described on the "Manage Nano Server" page of the Nano Server documentation at http://aka.ms/nanoserver:
$ip = "<IP address of Nano Server>"
Set-Item WSMan:\localhost\Client\TrustedHosts $ip
Enter-PSSession -ComputerName $ip -Credential "$ip\Administrator"
- In the PSSession that you entered in step 1, navigate to the C:\Windows\System32\winevt\Logs directory. A directory listing at this location displays the available logs. Notice that HardwareEvents.evtx is not listed when you search for it as follows:
- Run the following PowerShell command to create the registry key for the HardwareEvents log:
New-Item -Path HKLM:\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents
- Run the following command to verify that HardwareEvents.evtx is now available in the C:\Windows\System32\winevt\Logs directory: