MeasuredBoot C:\Windows\Logs\MeasuredBoot

C:\Windows\Logs\MeasuredBoot: binary TCG logs of Measured Boot (measurements recorded in the TPM), used to attest boot integrity.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

With Measured Boot, the firmware and the boot loader record a measurement of every component they launch in the TPM. Windows keeps the logs of those measurements in MeasuredBoot. An attestation service (for example one behind a compliance tool) uses them to check that the machine booted into an expected state.

What it contains

Binary .log files named by sequence numbers, in the TCG event log format. No text editor can read them.
They only exist on a machine with a TPM.

Risks and best practices

On a machine subject to attestation, these logs are the evidence presented to the service, so deleting them makes the integrity check fail.
Outside attestation, deleting them does not stop Windows from booting. You only lose investigation material about the boot chain.
They describe the machine’s boot configuration, so treat them as sensitive internal data.

Useful commands

# Files present, newest first
Get-ChildItem "$env:windir\Logs\MeasuredBoot" -Force -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object Name, Length, LastWriteTime

# TPM state
Get-Tpm

# TPM version and device information
tpmtool getdeviceinformation

# Secure Boot state
Confirm-SecureBootUEFI

Report a mistake