DFIRHub

Windows registry artifactEvent Logs Logging Status

Displays the status of Windows Event Log Channels (Key Path) on this system, 0 = Disabled, 1 - Enabled

  • Event Logs
  • 1 key
  • SOFTWARE

Registry keys

1 key that RECmd reads for this artifact

  • SOFTWAREEnabledrecursive
    Microsoft\Windows\CurrentVersion\WINEVT\Channels

    Displays the status of Windows Event Log Channels (Key Path) on this system, 0 = Disabled, 1 - Enabled

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)