The Event Viewer is, for the most part, a passive tool that tracks system errors and events of interest. Events can be created by users with the appropriate authority (administrative privileges) and indeed, applications and services can generate custom errors.

The Event Viewer is, by default, divided up into five different sections, despite current server configuration. The Application, Security, and Systems logs have been around since the days of NT, and serve as logs generated by applications, security events (such as logon/logoff and auditing events) and Systems events (such as driver failures).

New with Windows 2000 and Server 2003 are the Directory Services logs, which monitor NTDS (NT Directory Services) events in member servers and XP systems or Active Directory events in domain controllers; DNS logs, which are latent if DNS is not installed locally; and replication logs, which are again latent for all but domain controllers within the domain.

Each event’s properties can be double-clicked for more information. New with Windows Server 2003 is the ability to automatically search the Microsoft Technet Web site for a particular event message. This is definitely a huge plus on the troubleshooting trail, because it eliminates the need to perform the search manually (which is time consuming) on a separate computer.