How To Customize Windows 10 Event Log Location

In this registry workshop, learn how to customize Windows 10 event log location. By default, event logs are saved to %SystemRoot%\SYSTEM32\WINEVT\LOGS.

Kapil Arya
11x Microsoft MVP · Admin
2 min read
Add as a preferred
source on Google

When you’re working on your Windows, events may be ongoing with system processes and features. These events will write log files that can be used to analyze in case if these events fails. Along with this, event log files will also provides detailed information about events occurred.

By default, Event Viewer logs are saved to %SystemRoot%\SYSTEM32\WINEVT\LOGS. If you’ve requirement of customizing default log location and allow Event Viewer to write log at some other location, this article is for you. Try the registry manipulation mentioned below to customize Windows event log location.

How To Customize Windows 10 Event Log Location

Registry Disclaimer: The further steps will involve registry manipulation. Making mistakes while manipulating registry could affect your system adversely. So be careful while editing registry entries and create a System Restore point first.

1. Press W8K + R and put regedit in Run dialog box to open Registry Editor (if you’re not familiar with Registry Editor, then click here). Click OK.

Windows 10 Registry Editor

2. In left pane of Registry Editor window, navigate to following registry key:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog

How To Customize Windows 10 Event Log Location

3. Create a registry sub-key to EventLog registry key. Name it as Security, if you want to configure custom logs for Security logs. Or name is as Application, System or Setup, depending upon the custom logs you want. In the right pane of registry sub-key, create a registry string (REG_SZ) named File. Double click on the registry string to modify its Value data:

How To Customize Windows 10 Event Log Location

4. Set the Value data as custom log location, for example, C:\CustomLogs. You need to make sure that this custom folder is writeable. Note that Event log service should have permissions to write logs at this location. This can be confirmed if SYSTEM is the owner of custom folder. Read more details in this article. Click OK and close Registry Editor.

Reboot and then Event Viewer should be able to write logs to your custom folder or log location.

That’s it!

Related: Event Viewer Not Working In Windows 10.

Share this article
https://www.kapilarya.com/how-to-customize-windows-10-event-log-location

Shareable URL

Article by

Kapil Arya
11x Microsoft MVP · Admin

Kapil holds Microsoft MVP title in Windows IT Pro expertise, 11-times in a row (2014-2025). He is 8-times Windows Insider MVP as well, and author of 'Windows Group Policy Troubleshooting' book. In 2015, Microsoft India accomplished him as 'Windows 10 Champion'. Being passionate Windows blogger, he loves to help others on fixing their system issues. Kapil has worked with official Microsoft Community Engagement Team (CET) on several community projects. You can subscribe him for news/updates and fixes for Windows.

Leave a Comment

Your email address will not be published. Required fields are marked *