Protect your Event Log

Tweak #29 - april 10, 2002

By default, all users can read your event log over the network.

If you don't want this, use this registry hack to disable the default Event Log sharing.

The tweak

Go to the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

This key has three subkeys, one for each log. They are called Application, Security and System.

In every key, create the following REG_DWORD value:

RestrictGuestAccess

Set this value to 1.

You can of course choose which logs to protect.