Configure the logging level (log level) for the certification authority event log
Some Windows events generated by the certification authority are only generated from a certain logging level.
The following describes how to determine and change the logging level of a certification authority.
The logging level is stored under the following registry key of the certification authority.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\LogLevelIt can also be determined with the following command:
certutil -getreg CA\LogLevelThe default value is 3 (CERTLOG_WARNING).
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
The numerical values are translated into the following variables:
| Value | Meaning | Additional events |
|---|---|---|
| 0 | CERTLOG_MINIMAL | |
| 1 | CERTLOG_TERSE | |
| 2 | CERTLOG_ERROR | |
| 3 | CERTLOG_WARNING | (default setting) |
| 4 | CERTLOG_VERBOSE | 52 , 68 , 69 , 70 , 71 , 72 , 73 , 76 , 97 |
| 5 | CERTLOG_EXHAUSTIVE |
The log level can be changed with the following command:
certutil -setreg CA\Loglevel {LogLevel}Increasing the logging level can generate a lot of events. Accordingly, it should be ensured that the event log can grow accordingly. Otherwise, earlier events will be overwritten. It is advisable to increase the logging level only temporarily.
Afterwards, the certification authority service must be restarted.
Restart-Service -ServiceName CertSvcRelated links:
External sources
- How to Change the Event Logging Level for Certificate Services (Microsoft, archive link)