Win 11 Event Viewer summary doesn't match events

Question

Windows 11 Pro 25H2 build 26200.8037 on desktop PC (i7-9700, 16 GB RAM, NVidia GPU)

Noticed today that logs for some entries listed in the Summary of Administrative Events in Event Viewer don't match the actual event:

Notice that Event 103 AESMService shows Last Hour: 0; 24 hours: 1

When I open that event, it was logged: 3/23/2026 10:10:38 AM, (today) and I cold booted PC at ~10:10 AM, PDT:

I'm still within 1st hour after booting. and taskbar clock correctly shows current time. BIOS time is identical to what's shown on taskbar.

Same issue with the 10016 DistributedCOM error summary: Last Hour: 0; 24 Hours: 35. When I open that list of errors, there are 11 DCOM errors logged between 10:10 and 10:14 AM today.

So why isn't the Summary reporting the events correctly, if they're logged with correct date/time?

Answer 1

Hi Hero1318,

I understand why this can seem confusing. You checked the timestamps, system clock, and BIOS time, and everything is correct. You’re not missing anything, and nothing is broken on your system. Since Q&A Assist already explained the high‑level behavior, here what’s happening:

1. Summary of Administrative Events is not a real‑time view.
2. It is a cached, aggregated snapshot that Event Viewer periodically rebuilds
3. The counters for Last hour / 24 hours / 7 days are calculated separately from the live event list
4. After boot, resume, or heavy logging, those counters can lag or under‑count for a while. That’s why you see:
   1. Events clearly logged within the last hour
   2. But the Summary still shows Last hour: 0

Overall, the Summary view is delayed by design, so it should be treated as approximate only. Trust the individual event entries and their timestamps. You can use filters in the System / Application logs if you need accuracy.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The Summary of Administrative Events view in Event Viewer is known to be approximate and can temporarily show inconsistent counts compared to the underlying logs. The summary is generated by a background aggregation process over the System and other logs, and the counters for “Last hour”, “24 hours”, and “7 days” are not updated in real time for every new event.

Because of this, it is possible to see:

• Correct timestamps on individual events when opening the log directly, while
• The “Last hour” and “24 hours” columns in the Summary still reflect an earlier aggregation pass and under‑report recent events.

This behavior does not indicate a problem with the events themselves, the system clock, or the services that are logging the events. It is a limitation of how the Event Viewer summary view refreshes and groups events.

To verify actual activity, rely on the individual logs (for example, System, Application, or the specific operational/admin log) and their time filters rather than the Summary of Administrative Events counts.

---

References:

• Review events and errors using Event Viewer
• Required diagnostic events and fields for Windows 11, versions 23H2 and 22H2