HardwareEvents.evtx log is unavailable in Nano Server


By default in Windows Server 2016 Nano Server, the HardwareEvents.evtx log is unavailable.


To enable the HardwareEvents.evtx log in Nano Server, follow these steps:
  1. Log on remotely to Nano Server, as described on the "Manage Nano Server" page of the Nano Server documentation at http://aka.ms/nanoserver:

    $ip = "<IP address of Nano Server>"
    Set-Item WSMan:\localhost\Client\TrustedHosts $ip
    Enter-PSSession -ComputerName $ip -Credential "$ip\Administrator"
  2. In the PSSession that you entered in step 1, navigate to the C:\Windows\System32\winevt\Logs directory. A directory listing at this location displays the available logs. Notice that HardwareEvents.evtx is not listed when you search for it as follows:

    Set-Location C:\Windows\System32\winevt\Logs

  3. Run the following PowerShell command to create the registry key for the HardwareEvents log:

    New-Item -Path HKLM:\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents
  4. Run the following command to verify that HardwareEvents.evtx is now available in the C:\Windows\System32\winevt\Logs directory:

    Get-ChildItem C:\Windows\System32\winevt\Logs


Article ID: 3197427 - Last Review: Oct 11, 2016 - Revision: 1