In my attempts to research Windows disk writes, and getting more granular control over them I'm trying to find means to halt Windows event logging; which appears to be supported via Windows own
Wevtutil with the syntax:
wevtutil.exe sl "log_name" /e:falseAs there are so many event logs to disable doing it manually is impractical, and my knowledge of Windows scripting limited, so I thought I'd try and edit an existing script:
Code:
@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared! ^<press any key^>
goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo ^<press any key^>
:theEnd
REM pause>NUL
...which is used to enumerate all the logs into a variable and clear them... What I came up with though doesn't appear to work:
Code:
@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_halt "%%G")
echo.
echo Event Logs have been halted! ^<press any key^>
goto theEnd
:do_halt
echo halting %1
wevtutil.exe sl %1 /e:false
goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo ^<press any key^>
:theEnd
pause>NUL
...as events are still being logged... If anyone here with Sindows scripting talent can offer any help or advice, it would be much appreciated...
