http://blogs.msdn.com/embedded/archive/2008/08/25/tip-of-the-day-moving-event-viewer-logs-to-an-unprotected-volume.aspxThis tip is applicable to Enhanced Write Filter (EWF-RAM) users. To move Event Viewer logs to a volume unprotected by EWF, modify the following three registry keys as shown in the following example. The example uses drive D as the unprotected volume.en-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/embedded/archive/2008/08/25/tip-of-the-day-moving-event-viewer-logs-to-an-unprotected-volume.aspx#8917166Mon, 01 Sep 2008 20:47:22 GMT91d46819-8472-40ad-a661-2c78acb4018c:8917166Architecture & Stuff<p>I don't ordinarily just copy stuff that someone else sends me into my blog, but this is an exception.&amp;#160;</p>