Windows registry artifactApplication Event Log Providers
Displays the status of Providers within the Application Event Log on this system, 0 = Disabled, 1 - Enabled
- Event Logs
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMrecursiveControlSet001\Control\WMI\Autologger\EventLog-ApplicationDisplays the status of Providers within the Application Event Log on this system, 0 = Disabled, 1 - Enabled
References
1 link
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)