Event Log Channel Metadata Registry Key Path

In Windows operating systems, the metadata definitions and configurations for all registered event log channels are cataloged directly within the Windows Registry. This article details the exact registry path used by the Windows Event Log service (WINEVT) to store channel metadata, describes the key values stored in these definitions, and outlines how these entries link to their respective event publishers.

Primary Registry Path for Channel Metadata

Registered event log channel metadata is stored under the following Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels

Under the Channels key, every registered Windows Event Log channel (such as Application, System, Security, or custom provider channels like Microsoft-Windows-PowerShell/Operational) has its own dedicated subkey matching the exact name of the channel.

Common Channel Metadata Values

Each channel subkey contains specific configuration values that define its behavior, access restrictions, and provider associations:

• OwningPublisher (REG_SZ): The GUID of the primary event provider/publisher that created and owns the channel definition.
• Enabled (REG_DWORD): A boolean flag indicating whether the event log channel is actively capturing events (1 = enabled, 0 = disabled).
• ChannelType (REG_DWORD): Specifies the type of channel (e.g., 1 for Admin, 2 for Operational, 3 for Analytic, 4 for Debug).
• Isolation (REG_DWORD): Defines the channel’s isolation model (such as 1 for Application, 2 for System, or 3 for Custom).
• Access (REG_SZ): Contains the Security Descriptor Definition Language (SDDL) string specifying user and service permissions for reading, writing, and clearing the log channel.

Associated Provider Definitions

To view the provider metadata referenced by a channel’s OwningPublisher GUID, navigate to the adjacent registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{PROVIDER-GUID}

This key contains the localized message file paths (MessageFileName, ResourceFileName) and channel references associated with the specific publisher.