请教win7企业版如何改变日志文件地址呢？

显示全部楼层 · 发表于 2014-1-17 18:05:49

本帖最后由 cz88 于 2014-1-19 19:28 编辑

由于怕被系统还原所以想放在别处

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application]
"File"=hex(2):45,00,3a,00,5c,00,61,00,75,00,74,00,6f,00,72,00,75,00,6e,00,2e,\
  00,69,00,6e,00,66,00,5c,00,30,00,31,00,5c,00,41,00,70,00,70,00,6c,00,69,00,\
  63,00,61,00,74,00,69,00,6f,00,6e,00,2e,00,65,00,76,00,74,00,78,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Security]
"File"=hex(2):45,00,3a,00,5c,00,61,00,75,00,74,00,6f,00,72,00,75,00,6e,00,2e,\
  00,69,00,6e,00,66,00,5c,00,30,00,32,00,5c,00,53,00,65,00,63,00,75,00,72,00,\
  69,00,74,00,79,00,2e,00,65,00,76,00,74,00,78,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System]
"File"=hex(2):45,00,3a,00,5c,00,61,00,75,00,74,00,6f,00,72,00,75,00,6e,00,2e,\
  00,69,00,6e,00,66,00,5c,00,30,00,33,00,5c,00,53,00,79,00,73,00,74,00,65,00,\
  6d,00,2e,00,65,00,76,00,74,00,78,00,00,00

发现重启后未知没有改变怎么解决呢？

win7日志改变

显示全部楼层 · 发表于 2014-1-17 19:53:22

把这堆Hex地址丢进去那啥……丢进去WinHEX里面，然后把显示出来的地址改成你想要的地址，或者至少也可以看看是个什么玩意儿。

显示全部楼层 · 发表于 2014-1-19 19:27:27

就是改成别的地址了但是系统日志里面却没有变

[系统] 请教win7企业版如何改变日志文件地址呢？