4

Someone changed the system language via taskbar button on our win10 machine, which lead to several subsequent problems with custom software.

Does this event get logged in win10 and where would I be able to see it and find out when this exactly happened?

Improve this question

2 Answers 2

Reset to default
3

I’ve tested it in my lab and found no log recording the change of the default system language.

To see subsequent changes, we could implement the following steps.

  1. Enable audit policy：

    • Navigate to Local Group Policy Editor>Windows Settings>Security Settings>Advanced Audit Policy Configuration>System Audit Policies>Object Access
    • Right-click Audit Registry>>properties>Configure the following audit events>success and failure>apply>ok

  2. Change the security settings of a registry key：

    • Open the Registry Editor
    • Navigate to Computer>HKEY_USERS>S1-5-21(-2146773085-903363285-719344707-2394726 This part is different according to different user)>International>User Profile
    • Right-click the key and select permissions.

To supplement the answer, I changed the system language in my lab and found the relevant log(navigate to event viewer>windows logs>security>event ID 4657) below. From the capture, we can see the value of "Language" key is changed, meanwhile, the time of changing is recorded.enter image description here

Improve this answer
4
  • Hi li, thanks for the answer! It was really hard to read so robinCTS and me had to improve your formatting.
    – Vlastimil Ovčáčík
    Commented Aug 21, 2018 at 10:37
  • Sorry for my carelessness. Thx
    – li Lavilian
    Commented Aug 22, 2018 at 2:27
  • thx a lot - good idea - what does it log then?
    – haemse
    Commented Aug 23, 2018 at 13:30
  • Hi haemse, I edited my answer with the subsequent log. You can have a look.
    – li Lavilian
    Commented Aug 24, 2018 at 6:11
1

As I understand it, you would like to find out when the system language and/or keyboard is changed, right?

I searched online, some guys said we may find it in Event application log. But I tried on my side, did not find it. If you can find it on your side, please feel free to let us know.

As far as I know, if we downloaded language package then installed it, we should be able to find related information in Windows Update log and the CBS log. You can have a try.

In addition, if we changed the system language or keyboard, we need to logged out and logged in to make it take effect, so you can take a look at the Winlogon logs. It may give you a hint. Right-click the taskbar to open Event View, clicking on Windows Logs, and then clicking System.

Hope above information is helpful for you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .