Read Event Viewer Log for Untrusted Font Blocking in Windows 10

How to Read Event Viewer Log for Untrusted Font Blocking in Windows 10

Windows 10 comes with TrueType fonts and OpenType fonts installed out-of-the-box. They either have TTF or OTF file extensions. They support scaling and look sharp on modern displays. The OS comes with an advanced security feature that prevents fonts from being loaded outside of the c:\Windows\Fonts folder, considering them untrusted. Here's how to find a log event for a untrusted font blocked by the OS.

You may be familiar with the classic Fonts Control Panel applet, which you could use to see the fonts that are currently installed, or to install or uninstall fonts.

Starting with build 17083, Windows 10 features a special section in the Settings app. The new section, called simply "Fonts", can be found under Personalization.

Instead of the classic applet, recent releases of Windows 10 offer the Fonts page in Settings, which is able to show off newer font capabilities, such as color fonts or variable fonts. A refresh of the Fonts UI to show off the newer capabilities was long overdue.

In Settings, a dedicated page for Fonts settings provides a short preview of each font family. The previews use a variety of interesting strings that are selected to match the primary languages that each font family is designed for, together with your own language settings. And if a font has multi-color capabilities built into it, then the preview will demonstrate this.

Untrusted Font Blocking in Windows 10

The Untrusted Font Blocking security feature in Windows 10 is implemented as a global option that prevents apps from loading untrusted fonts. When enabled, any font that is located outside of the C:\Windows\Fonts folder, considered untrusted. This option can be set to one of the following values: On, Off, and Audit. You can configure it with a Group Policy (where available), or by applying a Registry tweak.

There are 3 ways to use this feature:

• On. Helps stop any font processed using GDI from loading outside of the %windir%/Fonts directory. It also turns on event logging.
• Audit. Turns on event logging, but doesn’t block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log.
• Exclude apps to load untrusted fonts. You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see Fix apps having problems because of blocked fonts.

To Enable Untrusted Font Blocking in Windows 10, see the following article.

To Read Event Viewer Log for Untrusted Font Blocking in Windows 10,

1. Press the Win + R keys together on the keyboard to open the Run dialog, type eventvwr.msc, and press the Enter key.
2. In Event Viewer, select Application and Service Logs > Microsoft > Windows > Win32k > Operational on the left.
3. Find EventID = 260 in the list and check out its contents.
4. In details, see the FontType value. If it is Memory, there will be no associated FontPath. For the the FontType = File, you will see an associated FontPath, e,g, FontPath: \??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF.

That's it.

Related articles:

• Backup and Restore Font Settings in Windows 10
• Delete and Uninstall a Font in Windows 10
• How To Rebuild Font Cache in Windows 10
• Change ClearType Font Settings in Windows 10
• How to Install Fonts in Windows 10
• How To Install Fonts From Microsoft Store In Windows 10
• How to a Hide a Font in Windows 10
• Hide a Font Based on Language Settings in Windows 10
• Restore Default Font Settings in Windows 10

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options: