Block Non-Admin Access to Event Logs with Regedit
Restricting access to Windows Event Logs prevents standard, non-administrative users from viewing sensitive system operations, login attempts, and operational data. This guide provides a straightforward method for administrators to configure the local computer’s Registry via Regedit to deny log-reading permissions to non-administrators, ensuring critical diagnostic and security records remain accessible only to authorized accounts.
Step 1: Open the Registry Editor
- Press
Windows Key + Rto open the Run dialog box. - Type
regeditand pressEnter. - Select Yes when prompted by User Account Control (UAC) to run the tool with administrative privileges.
Step 2: Restrict Access to Classic Event Logs
For standard logs (Application, System, and Security), you can
enforce restrictions using the RestrictGuestAccess registry
value:
- In the Registry Editor, navigate to the following path:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog - Select the log you want to secure (such as
ApplicationorSystem). - Right-click the right pane, select New >
DWORD (32-bit) Value, and name it
RestrictGuestAccess. - Double-click
RestrictGuestAccess, set its Value data to1, and click OK. - Repeat this process for each standard log located under the
Eventlogkey.
Step 3: Configure SDDL Channel Access for Modern Logs
Windows manages advanced logs through the WINEVT
registry branch using Security Descriptor Definition Language (SDDL). To
strictly restrict a specific log to administrators:
- Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels - Expand the Channels key and select the specific log
channel you want to restrict (for example,
SecurityorMicrosoft-Windows-PowerShell/Operational). - In the right pane, double-click the
ChannelAccessstring value. - Replace the existing SDDL string with a restrictive string that only
grants permissions to Local System (
SY) and Built-in Administrators (BA), such as:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA) - Click OK to save the changes.
Step 4: Apply the Changes
Registry changes to the Event Log service require a service restart or system reboot to take full effect:
- Open Command Prompt as an Administrator.
- Run
shutdown /r /t 0to restart the computer immediately, or restart the system manually via the Start menu.
Once rebooted, non-administrative users attempting to open the Event Viewer or query logs via PowerShell or Command Prompt will receive an “Access is denied” error.