Top 7 Tips for Interpreting WifiHistoryView Records on Windows

How to Use WifiHistoryView to Recover Past Wi‑Fi Network Details

What WifiHistoryView does

WifiHistoryView (by NirSoft) reads Windows WLAN event logs and displays past wireless connection events — times, SSIDs, adapter names, BSSIDs, encryption, event type (Connected/Disconnected/Failed), event ID, and more. It can load history from the local system, an external event-log file, or a remote computer.

Step-by-step: download and run

1. Download: go to NirSoft’s WifiHistoryView page and download the ZIP for your Windows version.
2. Extract: unzip to a folder (no installer required).
3. Run: double-click WifiHistoryView.exe. If you see a SmartScreen or antivirus warning, allow only if you trust nirsoft.net. Run elevated (right-click → Run as administrator) for full event-log access.

Load history from different sources

• Local system: default — WifiHistoryView reads the Microsoft-Windows-WLAN-AutoConfig/Operational event log.
• External event-log file: F9 → Advanced Options → choose “External File” and select the EVTX file.
• Remote computer: F9 → Advanced Options → choose “Remote Computer” and enter computer name/IP (Administrator credentials required).

Interpreting the main columns

• Event Time — when the event occurred.
• Event Type — Connected / Disconnected / Failed To Connect / Network Association.
• SSID — network name.
• Profile Name — Windows profile used.
• BSSID — router/AP MAC address (helps identify the exact AP).
• PHY Type / Encryption — radio standard and encryption used.
• Event ID / Event Record ID — useful when correlating with Windows Event Viewer.

Recovering useful details

• Find previously used SSIDs and timestamps to confirm when you connected.
• Use BSSID to identify the exact access point (handy for identifying a specific router among multiple SSIDs).
• Check Encryption/PHY Type to determine security and capabilities of past networks.
• Use Disconnect Reason and Event ID to troubleshoot repeated drops or failures.

Exporting and saving results

• Select rows and press Ctrl+S (Save Selected Items) to export as CSV, TSV, HTML, XML, or text.
• Use column customization (Options → Choose Columns or command-line /Columns) to export only needed fields.
• Copy/paste directly into Excel for further analysis.

Command-line & automation (examples)

• Export local history to CSV:

  Code
  Copy CodeCopied
  WifiHistoryView.exe /scomma C:\temp\wifi-history.csv 

• Load from external EVTX and export specific columns:

  Code
  Copy CodeCopied
  WifiHistoryView.exe /LoadFrom 2 /Filename “C:\logs\System.evtx” /scomma C:\temp\out.csv /Columns “Event Time,Event Type,SSID,BSSID,Encryption” 

Tips and troubleshooting

• Run as Administrator to ensure access to event logs.
• If BSSID company names are empty, download oui.txt from IEEE and place it next to WifiHistoryView.exe to show vendor names.
• If an expected event is missing, check Windows Event Viewer (Microsoft-Windows-WLAN-AutoConfig/Operational) to confirm the original log exists.
• For multiple PCs, use the remote-load feature or copy EVTX files to analyze centrally.

Quick checklist to recover a lost network password (note)

WifiHistoryView shows SSIDs and connection events but does not reveal saved Wi‑Fi passwords. To recover a saved password for a known SSID on the same PC, use:

• Windows UI: Settings → Network & internet → Wi‑Fi → Manage known networks → select network → Show password (requires admin), or
• Command line: run (Admin)

  Code
  Copy CodeCopied
  netsh wlan show profile name=“SSID” key=clear 

Replace “SSID” with the network name.

Safety and legality

Only inspect event logs and network details from devices and networks you own or are authorized to analyze.

— End —