Create Custom Event Source Using Regedit

Creating a custom event source inside the Windows Application log allows your custom scripts, services, or software to write dedicated, easily identifiable messages directly into the Windows Event Viewer. This guide provides a straightforward, step-by-step walkthrough on how to manually register a new event source under the Application log by creating the appropriate keys and values using the Windows Registry Editor (regedit).

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog.
  2. Type regedit and press Enter or click OK.
  3. If prompted by User Account Control (UAC), click Yes to run the editor with administrative privileges.

Step 2: Navigate to the Application EventLog Key

Use the left navigation pane to browse to the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application

Step 3: Create the New Event Source Key

  1. Right-click the Application key in the left pane.
  2. Select New > Key.
  3. Name the new key with the exact name you want for your event source (for example, MyCustomApp).

Step 4: Configure the Event Source Values

To ensure Windows correctly formats and handles the event messages generated by your source, add the following values inside your new key:

  1. Select your new key (e.g., MyCustomApp).

  2. Right-click the empty space in the right pane, select New > Expandable String Value, and name it EventMessageFile.

  3. Double-click EventMessageFile and set its Value data to the path of a message DLL that handles standard text messages. A common default for standard Windows events is:

    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll

  4. Right-click the empty space in the right pane again, select New > DWORD (32-bit) Value, and name it TypesSupported.

  5. Double-click TypesSupported, set the Base to Hexadecimal, and enter 7 (or 1f to support all event types including Audit Success/Failure, Error, Warning, and Information). Click OK.

Step 5: Verify the Event Source

You can verify that the custom event source is functioning by writing a test event using PowerShell:

  1. Open PowerShell as Administrator.

  2. Run the following command:

    Write-EventLog -LogName Application -Source "MyCustomApp" -EntryType Information -EventId 1001 -Message "Test event log entry."

  3. Open Event Viewer (eventvwr.msc), navigate to Windows Logs > Application, and verify your event appears with the source name MyCustomApp.