Windows 10: Event Log local policy settings not working properly in W11 23H2, security log filing up.

Discus and support Event Log local policy settings not working properly in W11 23H2, security log filing up. in Windows 10 Software and Apps to solve the problem; Hi All,We're in the process of setting up our W11 deployment process and one of the options we're looking at is deploying W11 as an upgrade to W10... Discussion in 'Windows 10 Software and Apps' started by TimJButterworth, Apr 22, 2024.

  1. Event Log local policy settings not working properly in W11 23H2, security log filing up.


    Hi All,We're in the process of setting up our W11 deployment process and one of the options we're looking at is deploying W11 as an upgrade to W10 through SCCM. However, we've come across an odd issue as part of our testing.For fully up-to-date W11 23H2 deployments either as W10 22H2 upgraded to W11 23H2, or as a fresh W11 23H2 deployment, the Event Log setting for overwriting events when full does not match up with what is defined in local group policy. Thus, the security log fills up and prevents users logging in. For older W11 22H2 deployments that are then upgraded to W11 23H2 through Wi

    :)
     
    TimJButterworth, Apr 22, 2024
    #1

  2. Win-11 PC under domain controller, Security Log Full problem

    The issue of the security log filling up quickly can be caused by a number of factors, such as excessive logging or insufficient log size. Here are some steps you can take to help resolve the issue:



    1. Adjust the log retention policy: You can also adjust the log retention policy to overwrite older events when the log becomes full. To do this, open the Event Viewer, right-click on the Security log and select Properties. Under the When maximum event log size is reached section, select the Overwrite events as needed option.



    2 Reduce the amount of logging: If the security log is filling up quickly due to excessive logging, you can reduce the amount of logging by disabling unnecessary auditing policies or reducing the level of auditing. To do this, open the Group Policy Editor, navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy, and adjust the policies as needed.



    I hope these suggestions help you resolve the issue of the security log filling up quickly.

    Regards,

    Zunhui
     
    Zunhui Han, Apr 22, 2024
    #2
  3. W1zzard Win User
    How to properly log files

    When you want to record click the log to file checkbox, it will ask for a filename and then log into that file as long as GPU-Z is running

    Good idea though that we could save old data and dump it into log when enabled, I'll work on that for a future version
     
    W1zzard, Apr 22, 2024
    #3
  4. Tatty_One Win User

    Event Log local policy settings not working properly in W11 23H2, security log filing up.

    Saves log files ?

    You can either read the files in Windows or my preferred method is.....

    Download CCcleaner from here...........

    http://www.piriform.com/ccleaner

    You can then run cleaner, you will see the log files listed, then if you right click you can save as a text file and then have a read. You may also get an "error reporting" log listed seperatly.
     
    Tatty_One, Apr 22, 2024
    #4
Thema:

Event Log local policy settings not working properly in W11 23H2, security log filing up.

Loading...
  1. Event Log local policy settings not working properly in W11 23H2, security log filing up. - Similar Threads - Event Log local

  2. Event Log local policy settings not working properly in W11 23H2, security log filing up.

    in Windows 10 Gaming
    Event Log local policy settings not working properly in W11 23H2, security log filing up.: Hi All,We're in the process of setting up our W11 deployment process and one of the options we're looking at is deploying W11 as an upgrade to W10 through SCCM. However, we've come across an odd issue as part of our testing.For fully up-to-date W11 23H2 deployments either as...
  3. WinRM Security - Event Logs

    in Windows 10 Gaming
    WinRM Security - Event Logs: Hi, could someone please take a look at the logs attached and tell me if it's possible to tell by the logs if anyone might have used WinRM on my machine to gain unauthorized access? I use Windows 11 and I never set up WinRM to begin with. Thank you so much in advance....
  4. WinRM Security - Event Logs

    in Windows 10 Software and Apps
    WinRM Security - Event Logs: Hi, could someone please take a look at the logs attached and tell me if it's possible to tell by the logs if anyone might have used WinRM on my machine to gain unauthorized access? I use Windows 11 and I never set up WinRM to begin with. Thank you so much in advance....
  5. Event Log > Security Event ID 5156 and 5158 filling it up

    in Windows 10 Gaming
    Event Log > Security Event ID 5156 and 5158 filling it up: I am trying to use a Powershell scanner in PDQ Inventory which runs a PS1 and enter the returning data into the asset that scans the Security log for log on and log off events. The script then enters the data into that asset which allows us to see who has been using it and...
  6. Event Log > Security Event ID 5156 and 5158 filling it up

    in Windows 10 Software and Apps
    Event Log > Security Event ID 5156 and 5158 filling it up: I am trying to use a Powershell scanner in PDQ Inventory which runs a PS1 and enter the returning data into the asset that scans the Security log for log on and log off events. The script then enters the data into that asset which allows us to see who has been using it and...
  7. Event Log > Security Event ID 5156 and 5158 filling it up

    in Windows 10 Customization
    Event Log > Security Event ID 5156 and 5158 filling it up: I am trying to use a Powershell scanner in PDQ Inventory which runs a PS1 and enter the returning data into the asset that scans the Security log for log on and log off events. The script then enters the data into that asset which allows us to see who has been using it and...
  8. inadvertently edited local security policy and now I cant log back in

    in Windows 10 Installation and Upgrade
    inadvertently edited local security policy and now I cant log back in: Hello,I need an urgent help with Windows10. I was working on my virtual machine for a school project and was supposed to run a script to change ssecurity policy.By mistake, I ended up running that script on my actual laptop and thereafter I couldnt log back into my windows...
  9. thousands of security logs in event viewer

    in Windows 10 Support
    thousands of security logs in event viewer: I went to the Event Viewer to check why my system shut down and won't turn on for a few minutes after the shut down. Then I noticed that under "Windows Logs" >"Security", I have more than 10,000 "Audit Success" logs. more than 10 per second. Is this normal? EventID are...
  10. Security Event Log flooded with 4656 Events

    in AntiVirus, Firewalls and System Security
    Security Event Log flooded with 4656 Events: We are having issues with our Security event log within Event Viewer. It is my understanding when you perform Object Access auditing and enable it within Group Policy, you still need to enable auditing on the Objects (to be audited) themselves. We just enabled Object Access...