Windows 10: Event Log local policy settings not working properly in W11 23H2, security log filing up.

Hi All,We're in the process of setting up our W11 deployment process and one of the options we're looking at is deploying W11 as an upgrade to W10 through SCCM. However, we've come across an odd issue as part of our testing.For fully up-to-date W11 23H2 deployments either as W10 22H2 upgraded to W11 23H2, or as a fresh W11 23H2 deployment, the Event Log setting for overwriting events when full does not match up with what is defined in local group policy. Thus, the security log fills up and prevents users logging in. For older W11 22H2 deployments that are then upgraded to W11 23H2 through Wi

:)

 

Win-11 PC under domain controller, Security Log Full problem

The issue of the security log filling up quickly can be caused by a number of factors, such as excessive logging or insufficient log size. Here are some steps you can take to help resolve the issue:



1. Adjust the log retention policy: You can also adjust the log retention policy to overwrite older events when the log becomes full. To do this, open the Event Viewer, right-click on the Security log and select Properties. Under the When maximum event log size is reached section, select the Overwrite events as needed option.



2 Reduce the amount of logging: If the security log is filling up quickly due to excessive logging, you can reduce the amount of logging by disabling unnecessary auditing policies or reducing the level of auditing. To do this, open the Group Policy Editor, navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy, and adjust the policies as needed.



I hope these suggestions help you resolve the issue of the security log filling up quickly.

Regards,

Zunhui

 

How to properly log files

When you want to record click the log to file checkbox, it will ask for a filename and then log into that file as long as GPU-Z is running

Good idea though that we could save old data and dump it into log when enabled, I'll work on that for a future version

 

Saves log files ?

You can either read the files in Windows or my preferred method is.....

Download CCcleaner from here...........

http://www.piriform.com/ccleaner

You can then run cleaner, you will see the log files listed, then if you right click you can save as a text file and then have a read. You may also get an "error reporting" log listed seperatly.