HardwareEvents.evtx log is unavailable in Nano Server

Symptoms

By default in Windows Server 2016 Nano Server, the HardwareEvents.evtx log is unavailable.

To enable the HardwareEvents.evtx log in Nano Server, follow these steps:

Log on remotely to Nano Server, as described on the "Manage Nano Server" page of the Nano Server documentation at http://aka.ms/nanoserver:

$ip = "<IP address of Nano Server>"
Set-Item WSMan:\localhost\Client\TrustedHosts $ip
Enter-PSSession -ComputerName $ip -Credential "$ip\Administrator"
In the PSSession that you entered in step 1, navigate to the C:\Windows\System32\winevt\Logs directory. A directory listing at this location displays the available logs. Notice that HardwareEvents.evtx is not listed when you search for it as follows:

Set-Location C:\Windows\System32\winevt\Logs
Get-ChildItem
Run the following PowerShell command to create the registry key for the HardwareEvents log:

New-Item -Path HKLM:\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents
Run the following command to verify that HardwareEvents.evtx is now available in the C:\Windows\System32\winevt\Logs directory:

Get-ChildItem C:\Windows\System32\winevt\Logs

Keywords: kb

Article Info