← Microsoft Interview Insights

Microsoft·Software Engineer·Technical Phone Screen·Intermediate

Intermediate
Jul 2026

Summary

Interviewed for a security engineer role at Microsoft, got a technical question about Windows event logging that seemed basic but tripped me up more than I expected.

Questions Asked (1)

Q1

What are the standard event log names on Windows machines?

Technical Trade-offsRoot Cause Analysis
Author's notes

Knew the big ones off the top of my head, Security, System, Application, but then they just waited and I could tell they wanted more.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by listing the three primary Windows event logs—Application, System, and Security—and briefly explain their purposes. Then mention additional logs like Setup and Forwarded Events, and discuss how to access them via Event Viewer or APIs. Emphasize that while these are standard, custom logs can be created by applications.

Pro tip: Highlight that the Security log is often the most critical for auditing and requires special permissions to access, showing awareness of security contexts. Also, mention that modern Windows versions may include additional logs like 'Windows PowerShell' and 'Microsoft-Windows-*' channels, demonstrating up-to-date knowledge.

1. Identify the core logs

Name the three primary logs: Application, System, and Security. Briefly state their purpose: Application for app events, System for OS events, Security for audit events.

2. Mention additional standard logs

Include Setup and Forwarded Events. Explain that Setup logs are used during OS installation and upgrades, while Forwarded Events collect events from other machines.

3. Discuss access and management

Explain how to view these logs using Event Viewer (eventvwr.msc) or programmatically via Windows Event Log API, PowerShell (Get-EventLog, Get-WinEvent), or WMI.

4. Note custom and application-specific logs

Clarify that applications can create their own logs under 'Applications and Services Logs', and that these are not considered standard but are common.

5. Relate to root cause analysis

Explain how these logs are used for troubleshooting: System for hardware/driver issues, Application for app crashes, Security for unauthorized access attempts.

Key Points to Mention

  • Application, System, and Security logs are the three primary standard logs.
  • Setup and Forwarded Events are also standard but less commonly used.
  • Event Viewer (eventvwr.msc) is the primary GUI tool to access logs.
  • PowerShell cmdlets like Get-EventLog and Get-WinEvent allow programmatic access.
  • Security log requires administrative privileges to read.
  • Custom logs exist under 'Applications and Services Logs' and are created by applications.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.