How to Read Event Viewer Log for Untrusted Font Blocking in Windows 10


A font is a graphical representation of text that may include a different typeface, point size, weight, color, or design.

The Untrusted Font Blocking security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the C:\Windows\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit.

If you aren’t quite ready to enable Untrusted Font Blocking, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues.

After you turn this feature on, or start using Audit mode, you can look at your event logs for details.

You can exclude specific apps, allowing them to load untrusted fonts, even while Untrusted Font Blocking is turned on.

Untrusted Font Blocking Mode Description
On (enable) Block untrusted fonts and log events. Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.
Off (default - disable) Turns the feature off.
Audit Log events without blocking untrusted fonts. Turns the feature on, logging installation attempts to the event log, but not blocking untrusted fonts.

See also: Block untrusted fonts in an enterprise | Microsoft Docs

This tutorial will show you how to view the event logs in Event Viewer for details about Untrusted Font Blocking in Windows 10.



Here's How:

1. Press the Win+R keys to open Run, type eventvwr.msc into Run, and click/tap on OK to open Event Viewer.

2. In the left pane of Event Viewer, expand open Application and Service Logs > Microsoft > Windows > Win32k, and click/tap on Operational. (see screenshots below)

3. In the middle pane of Event Viewer for Operational, scroll down and select an EventID: 260 you want to review details about for Untrusted Font Blocking.

4. In the General tab of the selected EventID: 260, you will see the event log details about the file path, font type, font path, and if the font was blocked (true or false).

If the FontType is File, there will also be an associated FontPath.

If the FontType is Memory, there will be no associated FontPath.

Read Event Viewer Log for Untrusted Font Blocking in Windows 10-untrusted_font_blocking_event_log-1.jpg Read Event Viewer Log for Untrusted Font Blocking in Windows 10-untrusted_font_blocking_event_log-2.jpg


That's it,
Shawn


Related Tutorials



  • Windows 11 Tutorials