Turning off event logging through the registry
Several registry values control whether Windows keeps logging. Setting the EventLog service Start value to 4 disables the service at the next boot; moving the Security log file path points logging at a throwaway file; setting ProcessCreationIncludeCmdLine_Enabled to 0 drops the command line from process events. The recordings have six such writes across machines, made by reg.exe, by PowerShell and by a dropped executable. Installed software and Windows itself write thousands of values under Services and Policies on the clean client. Find the six that weaken logging.
Hint 1
TargetObject is the value's path and Details is what was written. The EventLog service is disabled when its Start value becomes DWORD (0x00000004).
Hint 2
Three different value paths are involved: ...\Services\EventLog\Start, a ...\Services\EventLog\...\File path, and ...\ProcessCreationIncludeCmdLine_Enabled.
How to defend against logging turned off through the registry
The rule runs in this browser; it is saved here so you can come back to it.
Events
11,088 events. Search filters the table; it does not affect the result.