EvtOpenSession function (winevt.h)

Establishes a connection to a remote computer that you can use when calling the other Windows Event Log functions.


EVT_HANDLE EvtOpenSession(
  [in] EVT_LOGIN_CLASS LoginClass,
  [in] PVOID           Login,
  [in] DWORD           Timeout,
  [in] DWORD           Flags


[in] LoginClass

The connection method to use to connect to the remote computer. For possible values, see the EVT_LOGIN_CLASS enumeration.

[in] Login

A EVT_RPC_LOGIN structure that identifies the remote computer that you want to connect to, the user's credentials, and the type of authentication to use when connecting.

[in] Timeout

Reserved. Must be zero.

[in] Flags

Reserved. Must be zero.

Return value

If successful, the function returns a session handle that you can use to access event log information on the remote computer; otherwise, NULL. If NULL, call GetLastError function to get the error code.


When you are finished with the session handle, call the EvtClose function. Closing the session handle will also close all open handles created in the session (closing the open handles cancels any current activity on those handles).

To connect to the remote computer, the remote computer must enable the "Remote Event Log Management" Windows Firewall exception; otherwise, when you try to use the session handle, the call will error with RPC_S_SERVER_UNAVAILABLE. The computer to which you are connecting must be running Windows Vista or later.

This function does not validate the credentials; the credentials are validated the first time you try to use the session handle. If the credentials are not valid, the call will fail with ERROR_ACCESS_DENIED.


For an example that shows how to use this function, see Accessing Remote Computers.


Requirement Value
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Target Platform Windows
Header winevt.h
Library Wevtapi.lib
DLL Wevtapi.dll

See also