Where to Find Event Log Providers in Regedit

This article explains how to locate and inspect registered system event log providers using the Windows Registry Editor (regedit). Windows manages event log providers through two main registry locations depending on whether they are modern Windows Event Log (Crimson) publishers or classic Windows event sources. Inspecting these locations allows administrators and developers to verify installed providers, review message resource file paths, and check channel configurations.

Modern Windows Event Log Publishers

The primary location for modern event log providers (introduced in Windows Vista and used in all subsequent versions) is under the WINEVT registry branch.

  1. Press Win + R, type regedit, and press Enter.
  2. Navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers

Inside the Publishers key, each registered provider is listed as a subkey identified by its unique GUID.

When you select a GUID subkey, the right pane displays the following values: * (Default): The friendly name of the provider (e.g., Microsoft-Windows-Kernel-General). * MessageFileName: The path to the binary (DLL or EXE) containing the message strings and metadata. * ResourceFileName: The path to the file containing localization resources. * Enabled: A DWORD value indicating whether the provider is active.

Classic System Event Log Sources

Legacy event log providers—often used by older applications and traditional services—are registered under the system services tree organized by event log type (Application, System, Security, etc.).

  1. In the Registry Editor, navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
  2. Expand the specific log category key, such as Application or System.
  3. Locate the subkey named after the specific event provider/source (e.g., EventLog\System\Service Control Manager).

Selecting a source subkey reveals its configuration values: * EventMessageFile: The path to the resource DLL containing event descriptions. * TypesSupported: A bitmask DWORD representing the event types the source can log (Error, Warning, Information). * CategoryMessageFile: (Optional) The path to the file containing category definitions.

Registered Event Channels

To view the specific channels where modern providers can publish events (such as Operational, Analytic, or Debug logs), navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels

Each subkey under Channels corresponds to a log channel path in the Event Viewer, detailing its storage configuration, access permissions, and logging levels.