Block Non-Admin Access to Event Logs with Regedit

Restricting access to Windows Event Logs prevents standard, non-administrative users from viewing sensitive system operations, login attempts, and operational data. This guide provides a straightforward method for administrators to configure the local computer’s Registry via Regedit to deny log-reading permissions to non-administrators, ensuring critical diagnostic and security records remain accessible only to authorized accounts.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. Select Yes when prompted by User Account Control (UAC) to run the tool with administrative privileges.

Step 2: Restrict Access to Classic Event Logs

For standard logs (Application, System, and Security), you can enforce restrictions using the RestrictGuestAccess registry value:

  1. In the Registry Editor, navigate to the following path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog
  2. Select the log you want to secure (such as Application or System).
  3. Right-click the right pane, select New > DWORD (32-bit) Value, and name it RestrictGuestAccess.
  4. Double-click RestrictGuestAccess, set its Value data to 1, and click OK.
  5. Repeat this process for each standard log located under the Eventlog key.

Step 3: Configure SDDL Channel Access for Modern Logs

Windows manages advanced logs through the WINEVT registry branch using Security Descriptor Definition Language (SDDL). To strictly restrict a specific log to administrators:

  1. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels
  2. Expand the Channels key and select the specific log channel you want to restrict (for example, Security or Microsoft-Windows-PowerShell/Operational).
  3. In the right pane, double-click the ChannelAccess string value.
  4. Replace the existing SDDL string with a restrictive string that only grants permissions to Local System (SY) and Built-in Administrators (BA), such as: O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)
  5. Click OK to save the changes.

Step 4: Apply the Changes

Registry changes to the Event Log service require a service restart or system reboot to take full effect:

  1. Open Command Prompt as an Administrator.
  2. Run shutdown /r /t 0 to restart the computer immediately, or restart the system manually via the Start menu.

Once rebooted, non-administrative users attempting to open the Event Viewer or query logs via PowerShell or Command Prompt will receive an “Access is denied” error.