Event Log Settings
Per-log size and retention, and whether a log channel is switched off.
Use it to tell whether a log was shrunk, redirected or disabled so records would be lost.
- SYSTEM
- Defence Evasion
What It Is
The Event Log service reads this key, in the SYSTEM hive, to find and manage each classic event log, such as Application, Security and System. Each log's subkey holds its settings, such as File for the path of the log file and the log's maximum size in bytes. Retention says whether old records are overwritten when the log is full, or kept while new events are discarded. Windows Vista redesigned event logging, and its newer logs, such as Microsoft-Windows-PowerShell/Operational, are channels with an Enabled switch under WINEVT\Channels in the SOFTWARE hive.
What It Proves
A log's maximum size cut to near zero forces rapid overwrite, and a channel's Enabled set to 0 stops it entirely. Either removes records from the change onward, which shows as a gap in that log.
What It Does Not Prove
The classic EventLog keys and the WINEVT channel keys cover different logs, so check both. Clearing a log is a separate action, recorded as event 1102.
Where It Lives
Event Log Settings lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The Security log is capped at 1 MB, so records overwrite fast. Date the change from the Security key last write time. |
| Records overwrite as needed, the normal setting. Read it with the size cap, which is what decides how much history survives. |
| The PowerShell Operational channel is off, so events 4103 and 4104 are dropped even with logging on. Date the change from the channel key last write time. |
How to Read It
Read the maximum log size, Retention and File values under Services\EventLog\<log> in the SYSTEM hive. Read Enabled under WINEVT\Channels\<channel> in SOFTWARE, where 0 means the channel is off. To put it right, restore the size and re-enable the channel, and treat the gap as evidence.
- When Windows Writes It
- When an administrator, Group Policy, or an attacker with admin rights changes a log setting.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Microsoft does not list which registry paths Defender records, so confirm writes to these keys appear before relying on it. A hit shows a setting changed, not records lost. A cleared Security log is event 1102.
// Event log size, retention or channel state changedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Event Log Settings shows.
- PowerShell LoggingTells a PowerShell channel switched off from logging turned off at the source.
- Audit PolicyTells a log switched off from events that were never audited.
- Logs Cleared, Security Event 1102Not in the RegistryTells a cleared log from one shrunk or switched off, and names who cleared it.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Learn: Eventlog registry key (opens in a new tab)
- Velociraptor: Windows.EventLogs.Modifications (opens in a new tab)
- MITRE ATT&CK T1685.001: Disable or Modify Tools: Disable or Modify Windows Event Log (opens in a new tab)
- Microsoft Learn: EVT_CHANNEL_CONFIG_PROPERTY_ID (the enabled attribute of a channel) (opens in a new tab)