Checking the EventLog Service

Event logging depends on the EventLog service (eventlog). If stopped, logs won't be recorded, and Event Viewer won't work.

• Check Status: Admin CMD/PowerShell -> sc query eventlog.

• Expected State: RUNNING. A STOPPED state is highly suspicious.