Network Connection Event Logs

Question

I'm running Windows 10 Pro on a desktop with an ethernet cable (not wi-fi) for connection to the internet. I would like to open some event log somewhere, then disconnect/reconnect my ethernet cable (causing a disconnection/reconnection to the internet) and see this event show up in that log (after a refresh, of course). But where can I see this? I am familiar with Windows 10 Event Viewer and have experimented with many different logs in many different categories to no avail. Surely Windows must log this event somewhere. I can't find anyone else who has asked this question and gotten a definitive answer.

Answer 1

I would like to open some event log somewhere, then disconnect/reconnect my ethernet cable (causing a disconnection/reconnection to the internet) and see this event show up in that log...

On my Windows 10 1809 machine I can see this in three places.

The most straightforward event is in the Applications and Services Logs/Microsoft/Windows/NetworkProfile log.  There is a EventId 4004  "Network State Change Event" that fires whenever a network connection is made or re-identified.

There are less straightforward events in the NCSI log.  The EventId 4042 Capability change tells you that this network discovery tool woke up and tried to figure out if you were on a real internet connection, on a domain network, or stuck behind a captive portal.

Last but not least, if you (don't have a static Ip address and) enable the DHCP/Operational log you can see Media State Events when a physical interface state changes as well as requests for IPs, address assignment, duplicate address checking, etc.  This log is much easier to read if you filter out some of the noise events with the event id filter -50091-50094.

(I work as a PFE for Microsoft Supporting Enterprise customers.  Please don't hold that against me.)

Answer 2

Thank you for your quick reply. This all looks like good advice to repair a computer, but mine's not broken. I want to leave the computer unattended for a while, come back later and see if and when I lost (wired) connection to the internet. Unplugging the ethernet cable while watching an event viewer seems to be a positive way to test my ability to do this. Perhaps there is a small app or script.

Answer 3

Hi, roybillstrom

You should check your network cable and its connections and check that they are working well, after these, check these links:

https://www.rizonesoft.com/downloads/complete-i...

https://www.rizonesoft.com/downloads/winsock-re...

If that does not work, follow these steps:

Press the Start key and type the word CMD, right click on the command prompt and select Run as administrator, enter the following commands one by one followed by the Enter key:

Sfc / Scannow

DISM.exe / Online / Cleanup-image / Scanhealth

DISM.exe / Online / Cleanup-image / Restorehealth

The execution of these processes may be delayed, do not forget to restart the computer to apply changes.

If it works, follow these others.

Any corrupt DLL files are best performed using built in utilities or using a repair upgrade method:

Open Start, type: CMD

Right click CMD

Click Run as administrator

Type in at the prompt OR Copy and Paste these one at a time : (Hit enter after each)

Dism /Online /Cleanup-Image /CheckHealth

Dism /Online /Cleanup-Image /ScanHealth

Dism /Online /Cleanup-Image /RestoreHealth

Also run the System File Checker utility:

Open Start, type: CMD

Right click CMD

Click Run as administrator

At the Command Prompt, type: sfc/scannow

This will check for any integrity violations

Restart your system

Answer 4

@robillstrom 

did you find a solution? I have the same question, how / where I can check if it was an Ehternet connection / disconection happened in the Windows 10. Based on the info I may judge if it is an OS glitch, router glitch or just somebody physically touched the cable.

Answer 5

ok I understand