FolderRisk: Caution

Logs C:\Windows\System32\winevt\Logs

Folder holding the Windows event logs in .evtx format, read by Event Viewer.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

This is where the Windows Event Log service writes its .evtx files: every log shown in Event Viewer maps to one of them. The location is stored in the Registry (the File value of each log), so it can be moved, for example to a dedicated volume on a server. This page covers what all logs share; each important .evtx has its own page.

What it contains

The classic logs: Application.evtx, Security.evtx, System.evtx and Setup.evtx.
The “Applications and Services Logs” channels: one file per channel, named after the channel path, for example Microsoft-Windows-PowerShell%4Operational.evtx.
Frequently consulted Operational channels: Microsoft-Windows-GroupPolicy%4Operational.evtx, Microsoft-Windows-TaskScheduler%4Operational.evtx.
On a domain controller or server, logs specific to the installed roles: Directory Service.evtx, DNS Server.evtx, DFS Replication.evtx.

Risks and best practices

The EventLog service holds these files open. Deleting them by hand wipes diagnostic and audit history. To clear or archive a log, use Event Viewer (“Save All Events As…”, “Clear Log”) or wevtutil.
Tune each log’s maximum size and retention (log properties or Group Policy) instead of purging the folder.
Security logs hold account names and addresses, so protect any copies.

Useful commands

# The 15 largest log files
Get-ChildItem "$env:windir\System32\winevt\Logs" -Force |
    Sort-Object Length -Descending | Select-Object -First 15 Name, Length, LastWriteTime

# Maximum size and retention of the System log
wevtutil gl System

Folder contents

Logs 18

Report a mistake