Windows Event ID 5138 – Microsoft-Windows-Security-Auditing: Registry Value Deleted

Start by examining the specific Event ID 5138 entries to understand what registry values were deleted and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 5138 in the Event IDs field and click OK
5. Double-click on Event ID 5138 entries to view detailed information
6. Review the General tab for registry key path, value name, and account information
7. Check the Details tab for additional XML data including process information

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5138} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

If Event ID 5138 entries are not appearing despite registry changes, verify and configure registry auditing policies.

1. Open Local Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
3. Double-click Audit Registry
4. Check Configure the following audit events
5. Enable both Success and Failure checkboxes
6. Click OK and close Group Policy Editor
7. Run gpupdate /force to apply changes immediately

Verify the audit policy is active:

auditpol /get /subcategory:"Registry" /r

Use PowerShell to analyze Event ID 5138 patterns and identify suspicious or unexpected registry deletions.

1. Query events from the last 24 hours:

$StartTime = (Get-Date).AddDays(-1)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5138; StartTime=$StartTime}
$Events | ForEach-Object {
    $XML = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
        ProcessName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
        ObjectName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
        ObjectValueName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectValueName'} | Select-Object -ExpandProperty '#text'
    }
} | Sort-Object TimeCreated -Descending

2. Group deletions by user account to identify patterns:

$Events | Group-Object User | Sort-Object Count -Descending | Format-Table Name, Count -AutoSize

3. Export results for further analysis:

$Events | Export-Csv -Path "C:\Temp\RegistryDeletions.csv" -NoTypeInformation

Set up System Access Control Lists (SACL) on specific registry keys for granular monitoring of critical registry locations.

1. Open Registry Editor as Administrator
2. Navigate to the registry key you want to monitor (e.g., HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)
3. Right-click the key and select Permissions
4. Click Advanced button
5. Select the Auditing tab
6. Click Add to create a new audit entry
7. Click Select a principal and choose Everyone
8. Under Type, select All
9. Check Delete subkeys and values and Set value
10. Click OK to apply the SACL

Verify SACL configuration using PowerShell:

Get-Acl -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Audit | Select-Object -ExpandProperty Audit

Configure Windows Event Forwarding (WEF) to centralize Event ID 5138 collection across multiple systems for enterprise monitoring.

1. On the collector server, configure the Windows Event Collector service:

wecutil qc /q
Set-Service -Name Wecsvc -StartupType Automatic
Start-Service -Name Wecsvc

2. Create a subscription configuration file:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>RegistryDeletions</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Registry Value Deletions</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Normal</ConfigurationMode>
    <Query>
        <![CDATA[
            <QueryList>
                <Query Id="0">
                    <Select Path="Security">*[System[EventID=5138]]</Select>
                </Query>
            </QueryList>
        ]]>
    </Query>
</Subscription>

3. Import the subscription:

wecutil cs C:\Path\To\RegistryDeletions.xml

4. On source computers, configure the Windows Remote Management service and add the collector to the Event Log Readers group