DEV Community

Bryz︱🦾
Bryz︱🦾

Posted on

🕵️ "It Was Working Yesterday!" Use Reliability Monitor to Find What Changed

#itsupport #windows #troubleshooting #beginners

"It was working fine yesterday, and I didn't change anything." 😅

If you work help desk, you've heard this one a hundred times. Here's the thing: something almost always did change. A Windows update, a driver, a new app, a crash nobody noticed.

The good news? Windows quietly keeps a timeline of all of it. It's called Reliability Monitor, and it's one of the most underused tools on the box.

📈 Step 1: Open Reliability Monitor

Press Win + R and run:

perfmon /rel
Enter fullscreen mode Exit fullscreen mode

You can also search the Start menu for "View reliability history."

You'll see a chart with one column per day (switch to Weeks at the top if you need to look further back). The line at the top is a stability score from 1 to 10. When it drops, something happened.

🔍 Step 2: Click the day it broke

Ask the user when it last worked, then click that day and the day after. The rows under the chart show:

  • ❌ Critical events: app crashes, apps that stopped responding, Windows failures
  • ⚠️ Warnings: things like failed updates
  • ℹ️ Informational events: successful Windows updates, driver installs, app installs

The pattern you're hunting for: an ℹ️ install or update right before the ❌ crashes started.

🎯 Step 3: Read the details

Double-click any event (or use View technical details). For crashes you'll usually see the faulting app and module. For updates you'll see the KB number or driver name.

Now you have a real lead, like "the display driver updated Tuesday night and Teams started crashing Wednesday morning."

⚡ Bonus: Do it from PowerShell

Want the same info in a terminal, or on a remote session? Try these:

Recent reliability records:

Get-CimInstance -ClassName Win32_ReliabilityRecords |
  Sort-Object TimeGenerated -Descending |
  Select-Object -First 20 TimeGenerated, SourceName, ProductName, Message
Enter fullscreen mode Exit fullscreen mode

Recently installed updates:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Enter fullscreen mode Exit fullscreen mode

Errors and critical events in the System log from the last 2 days:

Get-WinEvent -FilterHashtable @{
  LogName   = 'System'
  Level     = 1, 2
  StartTime = (Get-Date).AddDays(-2)
} | Select-Object -First 20 TimeCreated, ProviderName, Message
Enter fullscreen mode Exit fullscreen mode

✅ Why this matters

Without a timeline, you're guessing: reinstall the app, reset the profile, reimage the laptop. With one, you're matching the problem to the change. That's faster for you, less painful for the user, and a lot easier to write up in the ticket.

Next time someone says "nothing changed," open perfmon /rel before you touch anything else. 🕵️

What's your first question when a user says "it was working yesterday"? Drop it in the comments 👇

Top comments (0)