v26.7.15.1008

All changes since the last stable release (v26.7.10.1209).

Highlights

• Find in the current view with Ctrl+F — an incremental, in-view Find bar searches the events you're already looking at and highlights matches as you type, with an inline match count, prev/next navigation (buttons, Enter / Shift+Enter, F3 / Shift+F3, with wrap-around), and Match case / Match whole word options. It searches the visible columns plus the always-on Description, scrolls the current match into view, and in grouped mode expands a collapsed group to reveal a hidden match (then re-collapses it once you move on). See Find in View below.
• Details Pane reader view — the Details Pane gains a Reader | XML tab strip. The Reader decodes an event's structured Event Data / User Data into named fields (arrays one per line, a hex preview for binary, muted placeholders for empty values), adds inline explanations for common values (a Logon Type decoder and a small curated Security-Auditing glossary), and offers per-field, per-section, and whole-event copy. The pane was re-laid-out into a metadata rail — identity, Level severity, and a correlation block — beside the message and data payload, with a severity dot that matches the event table exactly. See Details Pane Reader View below.
• Filter lenses — transient, reversible narrowing — a new lens stack layers temporary narrowing on top of your filters without touching the saved filter or exports. From an event's right-click menu: Show Related by Activity ID, Show Events Sharing Related Activity ID, Show Parent Activity, and Show Events Near This Time (a centered ±30s … ±1h window). Active lenses appear as removable breadcrumb chips above the table, Esc pops the top lens, and a lens clears itself automatically when you close the log it came from. See Filter Lenses below.
• Opcode and Related Activity ID event fields — events now expose their Opcode (resolved to its name, matching Event Viewer's precedence) and Related Activity ID. Both show in the reader view and are available as filter properties with value suggestions in the Basic filter editor. See Opcode & Related Activity ID below.
• Multi-value filtering (any-of / none-of) — Basic filter rows gain operator-aware multi-select matching, so one row can match any of several values or exclude all of them, including on named Event Data and User Data fields via Contains-Any. Empty values are handled safely so a stray blank can't quietly turn a filter into a match-all, and several built-in scenarios were refactored onto these collapsed multi-value rows. See Multi-Value Filtering below.
• Redesigned status bar — the status bar was rebuilt into a structured left / right layout: the active source and thousands-separated counts ("1,234 events", "200 of 1,234 shown" when narrowed, "3 selected" for a multi-select) plus a read-only Filtered indicator on the left; transient loading / failed / live-channel / resolver activity on the right. It also fixes a screen-reader defect where the entire bar re-announced on every count tick. See Status Bar below.
• Sharper threat-hunting scenarios — the built-in LOLBin and encoded-PowerShell scenarios were moved off brittle Description-text matching onto precise Event Data fields (NewProcessName, CommandLine), with a new proxied-execution scenario and -enc abbreviation coverage. See Scenarios below.

Features

• In-view Find (Ctrl+F) in the event table, with incremental highlighting, match count, wrap-around prev/next, and Match case / Match whole word toggles — see Find in View below.
• A Reader | XML tab strip in the Details Pane; the Reader decodes named Event Data / User Data fields, previews binary as hex, and explains common values (Logon Type, a Security-Auditing glossary) — see Details Pane Reader View below.
• Per-field, per-section, and whole-event copy from the Details Pane reader view.
• A Level severity dot in the Details Pane that mirrors the event table exactly (single shared source, so the two can't drift).
• A reversible filter lens stack driven from the event context menu: Show Related by Activity ID, Show Events Sharing Related Activity ID, Show Parent Activity, and Show Events Near This Time — see Filter Lenses below.
• A lens breadcrumb above the event table with per-lens remove chips, a Clear all action, and scoped Esc-to-pop.
• Opcode and Related Activity ID event fields, resolved and filterable, with value suggestions in the Basic filter editor — see Opcode & Related Activity ID below.
• Operator-aware multi-select filtering (contains-any / none-of) on scalar, Event Data, and User Data fields, with a round-trip-stable Advanced-text form — see Multi-Value Filtering below.
• A structured status bar with a left/right split, thousands-separated counts, a read-only Filtered indicator, and a fixed screen-reader announcement model — see Status Bar below.
• Built-in threat-hunting scenarios refined onto precise Event Data fields, plus a new proxied-execution LOLBin scenario — see Scenarios below.
• Automatic WinGet publishing — stable releases now publish to the Windows Package Manager automatically (via wingetcreate), so winget picks up new versions; the single multi-architecture .msixbundle covers both x64 and Arm64.

Find in View

• Ctrl+F opens a floating Find bar over the current event view; Esc closes it, restores grid focus, and lands the cursor on the current match. Find is a read-only overlay — it never dispatches a filter, lens, sort, or selection change, it only reads the view to derive matches.
• Incremental, debounced search as you type, across the enabled columns plus the always-on Description of the current view.
• The match count shows inline as N/M, with prev / next navigation from the bar buttons, Enter / Shift+Enter, and F3 / Shift+F3 — all wrap around, with a screen-reader announcement on wrap.
• Match case and Match whole word toggles in an options tray. Whole-word uses VS Code's word-boundary rule, so it stays correct for Event IDs, GUIDs, and hyphenated provider names, and queries with punctuation edges (.NET, -Auditing) remain findable.
• The current match's cells get highlighter-yellow inline marks; every matching row gets a neutral inset ring (weight-encoded — 2px on the current row, 1px on the others), with a forced-colors / high-contrast outline fallback.
• Group-aware navigation — Find expands a collapsed group to reveal a match and re-collapses the groups it opened once you navigate away, relinquishing ownership when you bulk- or context-toggle groups yourself.
• Match marks are rendered XSS-safe (Blazor-escaped segments, never raw markup) and capped per cell against a pathological hit count. Global Ctrl+F routes through a singleton coordinator to the currently mounted pane, so it stays correct across WebView reloads.

Details Pane Reader View

• A Reader | XML tab strip replaces the single XML view. The Reader decodes an event's structured Event Data and User Data into named fields, renders arrays one value per line, previews binary values as hex, and shows muted placeholders for empty or null fields.
• Inline explanations annotate common values: a Logon Type decoder and a small, curated Security-Auditing glossary explain what a value means without leaving the pane.
• Copy at every level — per field, per section, and the whole event.
• The pane was redesigned into a two-region layout: a metadata rail (event identity, Level severity, a correlation block, and a collapsible System section) beside a payload region (the provider Message, a multi-column Event Data grid, and User Data). It collapses to a single column when the pane is narrow, uses uniform two-size typography, stacks field rows so long field names never truncate, and packs Event Data into at most three columns.
• Level severity shows as a small coloured dot on Error / Warning that mirrors the log table exactly, via a shared LevelSeverity parse that the table's level styling now consumes too — one source, no drift.
• Correlation buttons — Show related events and Show parent activity — reuse the same filter-lens commands the row context menu drives (see Filter Lenses).
• The pane stays closed until you click an event, restoring the earlier committed behaviour.

Filter Lenses

• A filter lens is a transient, reversible narrowing layer applied on top of your persistent filter. Lenses live only in derived state — they never mutate your saved filters, the filter pane, or exports — so you can zoom in, look around, and pop back out cleanly.
• Show Related by Activity ID narrows the view to events that share the clicked event's Activity ID. Events with no Activity ID are correctly hidden rather than leaked.
• Show Events Sharing Related Activity ID narrows to events that share this event's Related Activity ID (siblings of the same parent/correlation activity).
• Show Parent Activity jumps to the parent activity's events — those whose Activity ID equals this event's Related Activity ID — with a distinct "Parent Activity = {guid}" chip.
• Show Events Near This Time is a context-menu submenu offering five centered windows — ±30s, ±1m, ±5m, ±15m, ±1h — that narrow the table to [TimeCreated − d, TimeCreated + d] with inclusive bounds, so the clicked event always stays in view. The chip reads, for example, Near 2:03:22 PM ±5m; window math is done in UTC while the chip anchor renders in the grid's display timezone. (Day-scale browsing remains the persistent date range's job.)
• Active lenses show as ...

v26.7.10.1209

All changes since the last stable release (v26.3.5.912).

Highlights

• Filter on named Event Data and User Data fields — two new filter properties, Event Data and User Data, let you filter on the structured fields inside an event instead of just its rendered description or XML. Pick Event Data or User Data in a Basic filter row and a field-name box appears: choose a field from the logs you have open (or type one, * wildcards allowed), then match its value. Values are compared by type, so 5 matches 05, a GUID matches in any format, and dates match the event's exact value. Several built-in scenarios now use these field filters out of the box. See Event Data & User Data Filtering below.
• Build provider databases from an offline Windows image — create a provider database from a Windows image instead of the running machine: a mounted volume, an extracted image folder, a .wim/.esd, a Windows install .iso, or a .vhdx/.vhd disk. The image kind is auto-detected from the path, ISOs and virtual disks are mounted read-only and cleaned up automatically, and the read is fully offline — the host registry and host files are never touched. Available from Database Tools → Create (with a Load editions picker for multi-edition images) and from EventDbTool create --offline-image. See Offline Image Databases below.
• Auto-import after Create and Merge — a new When finished choice on the Create and Merge tabs can Import (or Import and enable) the database you just built, so you don't have to switch to the Manage tab to start using it.
• Multiple provider versions in one database — provider databases now key providers by name and content version, so distinct versions of the same provider coexist instead of overwriting each other. Merge keeps the most complete version and prefers the newest OS source, and existing databases upgrade to the new layout automatically the first time they load.
• Native Arm64 support with a single self-contained installer — EventLogExpert now ships as one multi-architecture .msixbundle that runs natively on both x64 and Arm64 (Windows installs the matching build automatically), and it carries its Windows App Runtime inside the package, so there's no separate runtime to install on a clean machine. Existing installs update to it in place.
• Redesigned event table — the log table was rebuilt around a render-isolated store with filtering moved off the UI thread, so large logs scroll, filter, and update more smoothly, with per-tab groups for multiple open logs.
• Logs load newest-first — opening a log reads the newest events first and paints the first screenful immediately, so recent events are on screen right away instead of after a full load.
• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see **Eve...

v26.7.7.891

All changes since the last stable release (v26.3.5.912).

Highlights

• Filter on named Event Data and User Data fields — two new filter properties, Event Data and User Data, let you filter on the structured fields inside an event instead of just its rendered description or XML. Pick Event Data or User Data in a Basic filter row and a field-name box appears: choose a field from the logs you have open (or type one, * wildcards allowed), then match its value. Values are compared by type, so 5 matches 05, a GUID matches in any format, and dates match the event's exact value. Several built-in scenarios now use these field filters out of the box. See Event Data & User Data Filtering below.
• Build provider databases from an offline Windows image — create a provider database from a Windows image instead of the running machine: a mounted volume, an extracted image folder, a .wim/.esd, a Windows install .iso, or a .vhdx/.vhd disk. The image kind is auto-detected from the path, ISOs and virtual disks are mounted read-only and cleaned up automatically, and the read is fully offline — the host registry and host files are never touched. Available from Database Tools → Create (with a Load editions picker for multi-edition images) and from EventDbTool create --offline-image. See Offline Image Databases below.
• Auto-import after Create and Merge — a new When finished choice on the Create and Merge tabs can Import (or Import and enable) the database you just built, so you don't have to switch to the Manage tab to start using it.
• Multiple provider versions in one database — provider databases now key providers by name and content version, so distinct versions of the same provider coexist instead of overwriting each other. Merge keeps the most complete version and prefers the newest OS source, and existing databases upgrade to the new layout automatically the first time they load.
• Native Arm64 support with a single self-contained installer — EventLogExpert now ships as one multi-architecture .msixbundle that runs natively on both x64 and Arm64 (Windows installs the matching build automatically), and it carries its Windows App Runtime inside the package, so there's no separate runtime to install on a clean machine. Existing installs update to it in place.
• Redesigned event table — the log table was rebuilt around a render-isolated store with filtering moved off the UI thread, so large logs scroll, filter, and update more smoothly, with per-tab groups for multiple open logs.
• Logs load newest-first — opening a log reads the newest events first and paints the first screenful immediately, so recent events are on screen right away instead of after a full load.
• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see **Eve...

v26.6.30.1163

All changes since the last stable release (v26.3.5.912).

Highlights

• Build provider databases from an offline Windows image — create a provider database from a Windows image instead of the running machine: a mounted volume, an extracted image folder, a .wim/.esd, a Windows install .iso, or a .vhdx/.vhd disk. The image kind is auto-detected from the path, ISOs and virtual disks are mounted read-only and cleaned up automatically, and the read is fully offline — the host registry and host files are never touched. Available from Database Tools → Create (with a Load editions picker for multi-edition images) and from EventDbTool create --offline-image. See Offline Image Databases below.
• Auto-import after Create and Merge — a new When finished choice on the Create and Merge tabs can Import (or Import and enable) the database you just built, so you don't have to switch to the Manage tab to start using it.
• Multiple provider versions in one database — provider databases now key providers by name and content version, so distinct versions of the same provider coexist instead of overwriting each other. Merge keeps the most complete version and prefers the newest OS source, and existing databases upgrade to the new layout automatically the first time they load.
• Native Arm64 support with a single self-contained installer — EventLogExpert now ships as one multi-architecture .msixbundle that runs natively on both x64 and Arm64 (Windows installs the matching build automatically), and it carries its Windows App Runtime inside the package, so there's no separate runtime to install on a clean machine. Existing installs update to it in place.
• Redesigned event table — the log table was rebuilt around a render-isolated store with filtering moved off the UI thread, so large logs scroll, filter, and update more smoothly, with per-tab groups for multiple open logs.
• Logs load newest-first — opening a log reads the newest events first and paints the first screenful immediately, so recent events are on screen right away instead of after a full load.
• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see Event Export below.
• An empty-state scenario dashboard shown whenever no log is open, with a master-detail scenario browser, favorite scenarios that persist across sessions, and quick-launch buttons — see Scenarios below.
• A built-in scenario catalog of 217 curated triage scenarios across 20 groups, surfaced through an Apply Scenario picker in the filter pane that only lists scenarios matching the logs you have open — see Scenarios below.
• A date-range quick-pick (last 7 days through 2 years) that fills the After/Before filter date fields in UTC.
• The saved-filter-set picker gains a Replace button alongside Apply.
• Database Tools is available from th...

v26.6.22.1219

All changes since the last stable release (v26.3.5.912).

Highlights

• Native Arm64 support with a single self-contained installer — EventLogExpert now ships as one multi-architecture .msixbundle that runs natively on both x64 and Arm64 (Windows installs the matching build automatically), and it carries its Windows App Runtime inside the package, so there's no separate runtime to install on a clean machine. Existing installs update to it in place.
• Redesigned event table — the log table was rebuilt around a render-isolated store with filtering moved off the UI thread, so large logs scroll, filter, and update more smoothly, with per-tab groups for multiple open logs.
• Logs load newest-first — opening a log reads the newest events first and paints the first screenful immediately, so recent events are on screen right away instead of after a full load.
• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see Event Export below.
• An empty-state scenario dashboard shown whenever no log is open, with a master-detail scenario browser, favorite scenarios that persist across sessions, and quick-launch buttons — see Scenarios below.
• A built-in scenario catalog of 217 curated triage scenarios across 20 groups, surfaced through an Apply Scenario picker in the filter pane that only lists scenarios matching the logs you have open — see Scenarios below.
• A date-range quick-pick (last 7 days through 2 years) that fills the After/Before filter date fields in UTC.
• The saved-filter-set picker gains a Replace button alongside Apply.
• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events dis...

v26.6.19.275

All changes since the last stable release (v26.3.5.912).

Highlights

• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see Event Export below.
• An empty-state scenario dashboard shown whenever no log is open, with a master-detail scenario browser, favorite scenarios that persist across sessions, and quick-launch buttons — see Scenarios below.
• A built-in scenario catalog of 217 curated triage scenarios across 20 groups, surfaced through an Apply Scenario picker in the filter pane that only lists scenarios matching the logs you have open — see Scenarios below.
• A date-range quick-pick (last 7 days through 2 years) that fills the After/Before filter date fields in UTC.
• The saved-filter-set picker gains a Replace button alongside Apply.
• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, i...

v26.6.17.1367

All changes since the last stable release (v26.3.5.912).

Highlights

• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• A built-in scenario catalog of 217 curated triage scenarios across 20 groups, surfaced through an Apply Scenario picker in the filter pane that only lists scenarios matching the logs you have open — see Scenarios below.
• A date-range quick-pick (last 7 days through 2 years) that fills the After/Before filter date fields in UTC.
• The saved-filter-set picker gains a Replace button alongside Apply.
• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, importing, and exporting filter sets — see Filter Library below.
• The "Manage Databases" Select button is hidden when no databases are imported, so there's nothing to act on by mistake.
• Database Tools, Debug Log, Settings, Release Notes, and the Filter Library share a consistent vertical tab strip with full keyboard support (Up/Down/Home/End).
• Release notes for the current build are cached for in-app display, and pre-release builds auto-enable the pre-release update channel.
• Inline event grouping in the event table: right-click a column header and pick a column from the new Group By submenu ((none) turns it off) to fold related events under collapsible group headers — see Event Grouping below.

Scenarios

• Apply Scenario in the filter pane opens a grouped list of built-in scenarios — curated filter sets that target one or more event-log channels. The list is automatically narrowed to scenarios whose channels you actually have open, across both live logs and opened .evtx files (matched by channel name), so you only see scenarios that apply to your data.
• The built-in catalog ships 217 scenarios across 20 groups — system health, security, networking, server roles, common Microsoft products, and more. Group headers use curated display names.
• Each scenario ...

v26.6.16.1398

All changes since the last stable release (v26.3.5.912).

Highlights

• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, importing, and exporting filter sets — see Filter Library below.
• The "Manage Databases" Select button is hidden when no databases are imported, so there's nothing to act on by mistake.
• Database Tools, Debug Log, Settings, Release Notes, and the Filter Library share a consistent vertical tab strip with full keyboard support (Up/Down/Home/End).
• Release notes for the current build are cached for in-app display, and pre-release builds auto-enable the pre-release update channel.
• Inline event grouping in the event table: right-click a column header and pick a column from the new Group By submenu ((none) turns it off) to fold related events under collapsible group headers — see Event Grouping below.

Event Grouping

• Group the event table by any column except Description so related events fold under a shared header row. Grouping is most useful for an identifier such as Activity ID, but works for every column in the Group By submenu.
• Turn grouping on from a column header's right-click menu via the Group By submenu; (none) turns it back off. Re-selecting the column that's already grouped is a no-op, so the view doesn't rebuild needlessly.
• Groups are ordered by the grouped value, and events within each group keep the current Order By sort. Each header row shows the column name, the value (or (none) when it's empty), and the event count — for example Activity ID: {guid} (42).
• Group Descending flips the order of the groups themselves between ascending and descending, without changing the per-event Order By direction.
• Expand or collapse a group by clicking its header or chevron, or by pressing Enter while the header is focused. Expand All Groups and Collapse All Groups live on both the group header's right-click menu and the View menu. Collapse state is transient — it isn't persisted and resets when you switch to a different log tab.
• Select Group (on the group header's right-click menu) selects every event in a group, including events hidden by a collapse; Ctrl+A likewise selects events inside collapsed groups.
• When grouped, the table behaves as a keyboard-navigable tree grid — see UI / CSS / Accessibility below.

Database Tools & Manage Tab

• A new Manage tab in the Database Tools modal is the single place to enable/disable, upgrade, restore, remove, and retry classification on imported provider databases...

v26.6.11.1417

All changes since the last stable release (v26.3.5.912).

Highlights

• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, importing, and exporting filter sets — see Filter Library below.
• The "Manage Databases" Select button is hidden when no databases are imported, so there's nothing to act on by mistake.
• Database Tools, Debug Log, Settings, Release Notes, and the Filter Library share a consistent vertical tab strip with full keyboard support (Up/Down/Home/End).
• Release notes for the current build are cached for in-app display, and pre-release builds auto-enable the pre-release update channel.
• Inline event grouping in the event table: right-click a column header and pick a column from the new Group By submenu ((none) turns it off) to fold related events under collapsible group headers — see Event Grouping below.

Event Grouping

• Group the event table by any column except Description so related events fold under a shared header row. Grouping is most useful for an identifier such as Activity ID, but works for every column in the Group By submenu.
• Turn grouping on from a column header's right-click menu via the Group By submenu; (none) turns it back off. Re-selecting the column that's already grouped is a no-op, so the view doesn't rebuild needlessly.
• Groups are ordered by the grouped value, and events within each group keep the current Order By sort. Each header row shows the column name, the value (or (none) when it's empty), and the event count — for example Activity ID: {guid} (42).
• Group Descending flips the order of the groups themselves between ascending and descending, without changing the per-event Order By direction.
• Expand or collapse a group by clicking its header or chevron, or by pressing Enter while the header is focused. Expand All Groups and Collapse All Groups live on both the group header's right-click menu and the View menu. Collapse state is transient — it isn't persisted and resets when you switch to a different log tab.
• Select Group (on the group header's right-click menu) selects every event in a group, including events hidden by a collapse; Ctrl+A likewise selects events inside collapsed groups.
• When grouped, the table behaves as a keyboard-navigable tree grid — see UI / CSS / Accessibility below.

Database Tools & Manage Tab

• A new Manage tab in the Database Tools modal is the single place to enable/disable, upgrade, restore, remove, and retry classification on imported provider databases...

v26.6.10.1050

All changes since the last stable release (v26.3.5.912).

Highlights

• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, importing, and exporting filter sets — see Filter Library below.
• The "Manage Databases" Select button is hidden when no databases are imported, so there's nothing to act on by mistake.
• Database Tools, Debug Log, Settings, Release Notes, and the Filter Library share a consistent vertical tab strip with full keyboard support (Up/Down/Home/End).
• Release notes for the current build are cached for in-app display, and pre-release builds auto-enable the pre-release update channel.

Database Tools & Manage Tab

• A new Manage tab in the Database Tools modal is the single place to enable/disable, upgrade, restore, remove, and retry classification on imported provider databases.
• Edits in the Manage tab are staged and only applied when you save changes, so you can review (or back out) toggle changes, restores, and removals in one batch instead of one-at-a-time confirmations.
• Optional selection mode (toggled by a Select trigger) unlocks bulk Upgrade and bulk Remove across multiple databases.
• Multi-select removal of databases lets you take several entries out at once; the confirmation still warns you that affected logs will close and reopen.
• Per-row Upgrade progress is shown directly on each database row while an upgrade (or queued upgrade batch) is running.
• The Restore button respects in-flight upgrade progress, so an import-triggered upgrade can't be undercut by an accidental restore.
• Bulk Upgrade/Remove iterate in visible row order, so confirmation and focus stay predictable; failures stay selected (only succeeded entries are cleared) and the tab only auto-exits selection mode once every operation has succeeded.
• Esc in selection mode exits selection instead of closing the whole dialog.
• The attention banner now opens the Database Tools modal directly when there are databases that need attention.
• While the Database Tools modal is open, the attention banner is suppressed so it doesn't fight with the modal you're already using to act on it.
• The Manage tab is keyboard-friendly: action buttons use the real disabled attribute (so screen readers and keyboard users see the correct state) and the master selection checkbox is scoped so it doesn't leak styles to other tabs.
• Elevation on demand — when Create Database or Show Providers needs to read local providers (e.g., Security) without the app running as administrator, the tab shows a "Running without elevation…" note and a "Run Elevated" button that runs just that operation through a UAC-elevated helper. The app keeps running normally; Merge, Diff, and Upgrade are unaffected.

Database & Recovery

• New V4 provider database format with improved resolution coverage (merges in publishers that own a given channel).
• Imported databases get a clear status: classi...