How do I Filter the Windows Event Viewer for "Access Denied" or Antivirus blocks?

Here is the most effective way to do it for troubleshooting "Access Denied" or antivirus (AV) blocks.

1. The "Quick Filter" Method (By Keyword)

This is best for finding every mention of the Spirion process across a specific log.

1. Open Event Viewer (eventvwr.msc).
2. Navigate to the log you want to search (e.g., Windows Logs > Security or Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational).
3. On the right-hand Actions pane, click Filter Current Log....
4. In the "Includes/Excludes Words" box (near the bottom), type: spirion.exe
5. Click OK.
6. • Note: This will show every event where the Spirion executable is mentioned in the details.

2. The "Event ID" Method (Targeted Search)

If you are looking for specific types of blocks (like the ones we discussed previously), use the ID filter.

1. Click Filter Current Log....
2. In the Event IDs box, enter the IDs separated by commas.
3. • For Defender Blocks: Enter 1116, 1117.
   • For Permission Failures: Enter 4663, 4656 (Note: This only works in the Security log).
   • For App Crashes: Enter 1000, 1001, 7034.
3. Click OK.

3. The "XML" Method (Advanced/Most Powerful)

Sometimes the standard filter doesn't catch everything. You can use a custom XML query to find any event where the Service Account or the Process is involved.

1. Click Filter Current Log....
2. Go to the XML tab and check the box for Edit query manually.
3. Paste the following code (this example looks for the spirion.exe process specifically):

    <QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">
          *[EventData[Data[@Name='ProcessName'] and (Data='C:\Program Files\Spirion\Agent\bin\spirion.exe')]]
        </Select>
      </Query>
    </QueryList>

*(Adjust the path if your agent is installed in a custom location.)*

1. Click OK.

Tips for Effective Filtering

• Filter by Time: This is the most important step. Before filtering by ID, use the Logged dropdown to select "Last hour" or "Custom range" to match the exact time your Spirion scan was running.
• Check "Keywords": In the Security log, you can filter by Keywords. Select "Audit Failure" to see only the events where access was denied.
• Save Your Filter: If you find a filter that works well, click "Save Filter to Custom View..." in the Actions pane. You can name it "Spirion Troubleshooting" so you don't have to re-type the IDs next time.
• Clear the Filter: When you are done, don't forget to click "Clear Filter" in the Actions pane to see all events again.

Summary

Use Filter Current Log, enter the Event IDs (like 1116, 1117 for Defender), and narrow the Time range to match your scan window.