My goal is to move the Windows Log files to a different drive. There are some posts which describe how to do this, like this one .
I used a script which to set the log location to an alternative folder:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application" /v File /t REG_SZ /d "D\windowslog\Application.evtx" /f
This script runs without errors and does what it's supposed to do. It modifies the registry like it should do, however on one of the PC's where this script is run the log files are still run on the old, default location (C:\Windows\System32\winevt\Logs
)
Any idea why the event logs are written to a different location as indicated in the registry.
notes:
- the system was rebooted
- copying or moving the log files to the new location didn't help. They still kept being written at the default location
When I look on the Security settings of the C:\Windows\System32\winevt\Logs
folder I see a user "EventLog". I thought to add this user to have rights on the folder I created manually, but I can't select this user from the list of users and groups.
Security C:\Windows\System32\winevt\Logs
All Windows users