#event-id-5138

1 article

Windows Events1

Windows security monitoring dashboard showing registry audit events and system logs

Event 5138

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 5138 – Microsoft-Windows-Security-Auditing: Registry Value Deleted

Event ID 5138 records when a registry value is deleted on Windows systems with audit policies enabled. This security audit event helps track registry modifications for compliance and security monitoring.

March 189 min