---
title: "How do I Filter the Windows Event Viewer for \"Access Denied\" or Antivirus blocks?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-do-i-filter-event-viewer"
language: "en"
last_updated: "2026-05-29T01:50:56.613Z"
---

# How do I Filter the Windows Event Viewer for "Access Denied" or Antivirus blocks?

Filtering the Windows Event Viewer is the fastest way to isolate Spirion-related issues from the thousands of other system events.

Here is the most effective way to do it for troubleshooting "Access Denied" or antivirus (AV) blocks.

## 1\. The "Quick Filter" Method (By Keyword)

This is best for finding every mention of the Spirion process across a specific log.

1.  Open **Event Viewer** (`eventvwr.msc`).
2.  Navigate to the log you want to search (e.g., **Windows Logs > Security** or **Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational**).
3.  On the right-hand **Actions** pane, click **Filter Current Log...**.
4.  In the "Includes/Excludes Words" box (near the bottom), type: `spirion.exe`
5.  Click **OK**.
6.  -   *Note:* This will show every event where the Spirion executable is mentioned in the details.

## 2\. The "Event ID" Method (Targeted Search)

If you are looking for specific types of blocks (like the ones we discussed previously), use the ID filter.

1.  Click **Filter Current Log...**.
2.  In the **Event IDs** box, enter the IDs separated by commas.
3.  -   **For Defender Blocks:** Enter `1116, 1117`.
    -   **For Permission Failures:** Enter `4663, 4656` (Note: This only works in the **Security** log).
    -   **For App Crashes:** Enter `1000, 1001, 7034`.
4.  Click **OK**.

## 3\. The "XML" Method (Advanced/Most Powerful)

Sometimes the standard filter doesn't catch everything. You can use a custom XML query to find any event where the **Service Account** or the **Process** is involved.

1.  Click **Filter Current Log...**.
2.  Go to the **XML** tab and check the box for **Edit query manually**.
3.  Paste the following code (this example looks for the `spirion.exe` process specifically):

```xml
    <QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">
          *[EventData[Data[@Name='ProcessName'] and (Data='C:\Program Files\Spirion\Agent\bin\spirion.exe')]]
        </Select>
      </Query>
    </QueryList>
```

`*(Adjust the path if your agent is installed in a custom location.)*`

1.  Click **OK**.

* * *

## Tips for Effective Filtering

-   **Filter by Time:** This is the most important step. Before filtering by ID, use the **Logged** dropdown to select **"Last hour"** or **"Custom range"** to match the exact time your Spirion scan was running.
-   **Check "Keywords":** In the Security log, you can filter by **Keywords**. Select **"Audit Failure"** to see only the events where access was denied.
-   **Save Your Filter:** If you find a filter that works well, click **"Save Filter to Custom View..."** in the Actions pane. You can name it "Spirion Troubleshooting" so you don't have to re-type the IDs next time.
-   **Clear the Filter:** When you are done, don't forget to click **"Clear Filter"** in the Actions pane to see all events again.

## Summary

Use **Filter Current Log**, enter the **Event IDs** (like `1116, 1117` for Defender), and narrow the **Time range** to match your scan window.