Skip to content

Windows EVENTTRIGGERS command

The Windows eventtriggers command enables users to create, query, enable, disable, delete, and dump event triggers on a Windows system. This command is useful for automating tasks based on specific events or criteria within the operating system. Event triggers can be set up to run scripts or programs in response to events such as system startup, shutdown, or user logon. By using the eventtriggers command, users can efficiently manage and customize event triggers to meet their specific needs.

Terminal window
eventtriggers /query
OptionDescription
/createCreates a new event trigger.
/deleteDeletes one or more event triggers.
/queryDisplays a list of event triggers.
/queryidDisplays detailed information for an event trigger identified by its GUID.
ParameterDescription
/?Displays help for the command syntax.
/serverSpecifies the target server for the command (default is the local server).
/runSpecifies the command to execute when the event trigger is activated.
/trSpecifies the trigger event type (can be System, UserLogon, UserLogoff, Custom, or RemoteConnect).

Create an Event Trigger for System Startup

Section titled “Create an Event Trigger for System Startup”
Terminal window
eventtriggers /create /tr "StartupTrigger" /l system /eid 100 /tk "cmd /c echo System has started"

Creates an event trigger named “StartupTrigger” that will execute the command “echo System has started” when event ID 100 is triggered in the system log.

Terminal window
eventtriggers /query

Displays a list of all existing event triggers along with their details.

Terminal window
eventtriggers /delete /tn "StartupTrigger"

Deletes the event trigger named “StartupTrigger” from the system.

Terminal window
eventtriggers /query /tn "StartupTrigger" /v timeout
eventtriggers /set /tn "StartupTrigger" /ttl 300

Displays the current timeout value for the event trigger named “StartupTrigger” and sets the timeout to 300 seconds (5 minutes).

To use the eventtriggers command in Windows, execute the following command:

Terminal window
eventtriggers /query

What is the purpose of the eventtriggers command?

Section titled “What is the purpose of the eventtriggers command?”

The eventtriggers command is used to display and configure event triggers on a local or remote machine.

How can I view the list of event triggers on my Windows machine?

Section titled “How can I view the list of event triggers on my Windows machine?”

To view the list of event triggers, you can use the following command:

Terminal window
eventtriggers /query

How do I create a new event trigger using eventtriggers?

Section titled “How do I create a new event trigger using eventtriggers?”

To create a new event trigger, you can use the following command syntax:

Terminal window
eventtriggers /create /tr "<trigger_name>" /l <log_name> /so <source_name> /d <description> /t <task_name> /tk <task_command>

Can I delete an existing event trigger with eventtriggers?

Section titled “Can I delete an existing event trigger with eventtriggers?”

Yes, you can delete an existing event trigger using the following command:

Terminal window
eventtriggers /delete /tr "<trigger_name>"

How can I enable an event trigger using eventtriggers?

Section titled “How can I enable an event trigger using eventtriggers?”

To enable an event trigger, use the following command:

Terminal window
eventtriggers /enable /tr "<trigger_name>"

How do I disable a specific event trigger with eventtriggers?

Section titled “How do I disable a specific event trigger with eventtriggers?”

You can disable a specific event trigger by running the following command:

Terminal window
eventtriggers /disable /tr "<trigger_name>"
  • View a list of event triggers
  • Enable or disable event triggers
  • Create new event triggers
  • Delete existing event triggers