Unregister Windows Event Log Providers via Regedit

This guide explains how to safely locate and unregister unwanted or orphaned Windows Event Log providers using the Windows Registry Editor (Regedit). Removing these obsolete entries helps prevent error messages, cleans up leftover configuration data from uninstalled software, and stops unwanted events from cluttering your system logs.

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog.
  2. Type regedit and press Enter (or click OK).
  3. Click Yes when prompted by User Account Control (UAC).

Step 2: Locate the Event Provider Key

Windows stores event providers in two primary registry locations depending on whether they are classic event sources or modern ETW (Event Tracing for Windows) providers.

Option A: Classic Event Log Sources (Application, System, Security)

  1. Navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog

  2. Expand the target log category (such as Application or System).

  3. Locate the subkey named after the unwanted event provider.

Option B: Modern Event Providers (WINEVT Publishers)

  1. Navigate to:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers

  2. Each subkey is represented by a GUID (e.g., {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}).

  3. Click through the GUID keys and check the (Default) string value in the right pane to find the human-readable name of the provider you want to remove.

Step 3: Back Up the Registry Key

Before deleting any registry data, create a backup:

  1. Right-click the provider key you intend to remove.
  2. Select Export.
  3. Choose a safe location, name the file, and click Save.

Step 4: Delete the Unwanted Provider

  1. Right-click the identified provider key in the left navigation pane.
  2. Select Delete.
  3. Confirm the deletion when prompted by clicking Yes.

Step 5: Apply the Changes

To ensure the Windows Event Log service applies the changes and releases any cached provider metadata:

  1. Press Win + R, type services.msc, and press Enter.
  2. Locate the Windows Event Log service.
  3. If the option is available, right-click and choose Restart. If the service controls are grayed out, restart your computer to finalize the removal.

Step 6: Verify the Provider Removal

Open PowerShell as Administrator and run the following command to ensure the provider is no longer registered:

wevtutil enum-publishers | Select-String "ProviderName"

If the command returns no results, the provider has been successfully unregistered from the system.