How to Create Desktop Notifications For Windows Events

Martin Brinkmann
Aug 30, 2010
Tutorials, Windows, Windows tips

The Windows event log records all kinds of events automatically in the operating system, from application installs to hardware failures and user permission changes.

Many Windows users on the other hand ignore the event log, mostly because it takes some time to get used to it. The sheer size of the recorded events of a system, and the nimbus of being a tool for system administrator and experts are two additional factors that play a role.

The event log serves a few purposes, including the important option to troubleshoot PC issues and to receive notifications about potentially problematic issues. This can be helpful in fixing or repairing problems before they lead to data loss or hardware failures.

Not even the most thorough admin on the other hand wants to check the event log on a daily basis to discover events that need attention. That's a problem since it is important to react as soon as possible if critical or error level events occur.

That's why Microsoft added notifications options in the event log. Notifications can be configured to show up as desktop alerts or emails, so that it becomes possible to react as soon as the message is read.

The following guide has been created for Windows 7 systems, the menus and options may differ in other Microsoft operating systems.

Press Windows-R, type eventvwr.msc and hit enter to start the Event Viewer. Windows categorizes events in the two main groups Windows Logs, and Applications and Services Logs.

Each category consists of subgroups that display the events. The Actions sidebar lists the Create Custom View option. A click on that displays the following configuration menu:

event log
event log

Here it is possible to select an event level, e.g. critical or error, a specific event log, e.g. Windows Security or Internet Explorer in the Applications and Services logs, and specific event IDs.

There are more options than that but those are the three important ones. One needs to know the event ID of an event before it can be configured in here. Two options are available.

The first is to view the event log and check for critical or error levels. Those are the most severe levels and are written for instance if hardware fails.

The second option is to search the Internet for event ids. There is not a specific site that lists all events, but offers a search for events.

It is however also possible to select the critical or error level for instance and leave the Event IDs parameter at the default value which will catch all event IDs. This may however lead to lots of desktop notifications, depending on the amount of critical or error event levels on the PC.

Select a name for the new custom view in the next window.

critical errors
critical errors

The custom event view has now been configured. Now it is time to configure the desktop notifications for the new view.

To do that right-click on the newly created view in the Custom Views category on the left sidebar and select Attach Task To this custom view.

event notifications
event notifications

Click the Next button twice so that the Action step is displayed in the configuration window. Select Display A Message from the available options, and define the message after clicking next. A click on Finish in the last step completes the setup, and desktop notifications have been created for the selected event types and levels.

It is also possible to configure the notification to send an email instead, the configuration is similar with the exception that an SMTP server needs to be added in the task creation window.


Previous Post: «
Next Post: «


  1. Mike Bickett said on March 17, 2019 at 8:43 pm

    i will include my email at the end of this so someone hopefully gets back to me. so that idea above i tried but is not exactly what i want. and i have looked EVERYWHERE for sonmething that does! ALL I WANNA DO IS HAVE THAT POP be the actual log file verbose information! when windows does things, it is always behind the scenes. wouldnt it be nice as you are trying to log in with wifo in systray you could actually know WHY your connection is not working as opposed to a gerneric “could not connect”. what i want is when something occurs that i have checked to be watch…to launch the actual event viwer window with the error/warning! it makes so much sense to me and i am baffled why this was never implemented. so if i have a fan going down like i did last year i would know about it THE MINUTE IT IS HAPPENING…not months from afterwards after i look in the logs one day. does any of this make sense? thankyou

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.