Windows 10: Enable Log Event when Disk Quota Warning Level Exceeded in Windows

How to: Enable Log Event when Disk Quota Warning Level Exceeded in Windows


Information file system volumes, allowing administrators to control the amount of data that each user can store on a specific NTFS volume. Administrators can optionally configure the system to log an event when users are near their quota, and to deny further disk space to users who exceed their quota. Administrators can also generate reports, and use the event monitor to track quota issues.

Enforcing disk quota limits is optional. When users reach an enforced disk quota limit, the system responds as though the physical space on the volume were exhausted. When users reach an unenforced limit, their status in the Quota Entries window changes, but they can continue to write to the volume as long as physical space is available.

You can set Windows to record an event log in Event Viewer whenever users exceed their disk quota warning level on a NTFS volume.

This tutorial will show you how to enable or disable logging an event when users exceed their disk quota warning level in Windows 7, Windows 8, and Windows 10.

You must be signed in as an administrator to enable or disable logging an event when users exceed their disk quota warning level.


Note To see the event log for when users exceed their disk quota warning level:

A) Open Event Viewer (eventvwr.msc)
B) Open Windows Logs and System in the left pane of Event Viewer.
C) Look for events with an Event ID of 36 in the middle pane of Event Viewer.




CONTENTS:

• Option One: Enable or Disable Log Event when Disk Quota Warning Level Exceeded for Specific NTFS Drive in Drive Properties
• Option Two: Enable or Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives in Local Group Policy Editor
• Option Three: Enable or Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives using a BAT file

OPTION ONE [/i] Enable or Disable Log Event when Disk Quota Warning Level Exceeded for Specific NTFS Drive in Drive Properties
1. If you haven't already, you will need to first enable disk quotas for the NTFS drive (ex: "G") you want to enable or disable to log event event when a user exceeds their warning level.

2. Open This PC in File Explorer (Win+E).

3. Right click or press and hold on the NTFS drive (ex: "G") you want to enable or disable to log event when quota limit is exceeded for, and click/tap on Properties. (see screenshot below)



4. Click/tap on the Quota tab, and click/tap on the Show Quota Settings button. (see screenshot below)



5. Check (enable) or uncheck (disable) the Log event when a user exceeds their warning level box for what you want, and click/tap on OK. (see screenshot below)



6. Click/tap on OK. (see screenshot below step 4)

7. You may also want to:

• Enforce disk quota limit
• Specify default disk quota limit for new users
• Specify disk quota limit for specific users
• Turn on/off to log event when a user exceeds their quota limit

OPTION TWO [/i] Enable or Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives in Local Group Policy Editor


Note In Windows 7, the Local Group Policy Editor will only be available in the Professional, Ultimate, and Enterprise editions.

In Windows 8, the Local Group Policy Editor will only be available in the Pro and Enterprise editions.

In Windows 10, the Local Group Policy Editor will only be available in the Pro, Enterprise, and Education editions.

All editions can use Option Three below to set this same policy.

1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\System\Disk Quotas




3. In the right pane of Disk Quotas in Local Group Policy Editor, double click/tap on the Log event when quota warning level is exceeded policy to edit it. (see screenshot above)

4. Do step 5 (enable), step 6 (disable), or step 7 (not configured) below for what you would like to do.


5. To Enable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives


Note If you enable this policy setting, the system records an event when the user reaches their threshold. When you enable this policy setting, the system disables the "Log event when a user exceeds their warning level" option on the Quota tab so administrators cannot make changes using Option One.

A) Select (dot) Enabled, click/tap on OK, and go to step 8 below. (see screenshot below step 7)

6. To Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives


Note If you disable this policy setting, no event is recorded. When you disable this policy setting, the system disables the "Log event when a user exceeds their warning level" option on the Quota tab so administrators cannot make changes using Option One while this setting is in effect.

A) Select (dot) Disabled, click/tap on OK, and go to step 8 below. (see screenshot below step 7)

7. To Set Log Event when Disk Quota Warning Level Exceeded Policy to Not Configured


Note This is the default setting.

If you do not configure this policy setting, no events are recorded, but administrators can change the setting using Option One.

A) Select (dot) Not Configured, click/tap on OK, and go to step 8 below. (see screenshot below step 7)




8. When finished, you can close the Local Group Policy Editor if you like.

9. You may also want to:

• Enable or disable disk quotas. You will need to enable disk quotas to log event when warning level is exceeded.
• Enforce disk quota limit
• Specify default disk quota limit for new users
• Specify disk quota limit for specific users
• Turn on/off to log event when a user exceeds their quota limit

OPTION THREE [/i] Enable or Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives using a BAT file


Note The downloadable .bat files below will change the registry key and value below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DiskQuota

LogEventOverThreshold DWORD

(delete) = Not Configured (Default)
0 = Disabled
1 = Enabled

1. Do step 2 (enable), step 3 (disable), or step 4 (not configured) below for what you would like to do.


2. To Enable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives


Note If you enable this policy setting, the system records an event when the user reaches their threshold. When you enable this policy setting, the system disables the "Log event when a user exceeds their warning level" option on the Quota tab so administrators cannot make changes using Option One.

A) Click/tap on the Download button below to download the BAT file below, and go to step 5 below.

Enable_log_event_when_quota_warning_level_is_exceeded_for_all_NTFS_volumes.bat

Download

3. To Disable Log Event when Disk Quota Warning Level Exceeded for All NTFS Drives


Note If you disable this policy setting, no event is recorded. When you disable this policy setting, the system disables the "Log event when a user exceeds their warning level" option on the Quota tab so administrators cannot make changes using Option One while this setting is in effect.

A) Click/tap on the Download button below to download the BAT file below, and go to step 5 below.

Disable_log_event_when_quota_warning_level_is_exceeded_for_all_NTFS_volumes.bat

Download

4. To Set Log Event when Disk Quota Warning Level Exceeded Policy to Not Configured


Note This is the default setting.

If you do not configure this policy setting, no events are recorded, but administrators can change the setting using Option One.

A) Click/tap on the Download button below to download the BAT file below, and go to step 5 below.

Not_Configured_log_event_when_quota_warning_level_is_exceeded_for_all_NTFS_volumes.bat

Download
5. Save the .bat file to your desktop.

6. Unblock the .bat file.

7. Right click or press and hold on the downloaded .bat file, and click/tap on Run as administrator.

8. You will now see a command prompt open, apply the registry changes, update group policy, and automatically close.

9. You may also want to:

• Enable or disable disk quotas. You will need to enable disk quotas to log event when warning level is exceeded.
• Enforce disk quota limit
• Specify default disk quota limit for new users
• Specify disk quota limit for specific users
• Turn on/off to log event when a user exceeds their quota limit

That's it,
Shawn


Related Tutorials

• How to Enable or Disable Disk Quotas in Windows
• How to Enable or Disable to Enforce Disk Quota Limits in Windows
• How to Set Default Disk Quota Limit and Warning Level for New Users in Windows
• How to Set Disk Quota Limit and Warning Level for Specific Users in Windows
• How to Enable or Disable Log Event when Disk Quota Limit Exceeded in Windows

:)

 

Windows 10. Can't add new Disk Quota Entries.

We've get the latest and "the best" Creators update codenamed "Redstone 2". But please

We still have the same problem. Yes its a problem, not situation -A problem. Please get this serious. Gave as solution

I found other reports about this:

Windows 10. Can't add new Disk Quota Entries.

Same as

Quota Entries for C - Blank list

Same as

Quota Entries for C - Blank list

Also reported in the glorious Feedback Hub

 

Windows 10 - File Folder Quota Set - Is it possible?

Hi, please ask him for the exact text of the message- you can then research it properly.

See these - but these refer to a drive, not a folder:
How to use Windows 10 disk Quota to limit user storage | Windows Central
Enable or Disable to Enforce Disk Quota Limits in Windows | Windows 10 Tutorials
https://www.digitalcitizen.life/simple-questions-what-are-disk-quotas-how-set-them-windows

On another note, please encourage him to save personal data on another disk or partition- and in particular not on his desktop.

Things can go wrong on the 6 monthly upgrades, when people lose their desktop content being allocated temporary profiles.

And of course, back up. Disks fail. Bad things happen.

 

Windows Vista Tech Support

Go to the control panel, go to Administrative Tools, then Event Viewer. UAC will jump in asking for permission to continue, grant it.

Let it load - in the middle of the window you'll get a list of all the logged events... Critical, Error, Warning, Information, Audit Success and Audit Failure.

Don't get worried at how many errors/warnings you've got - every little thing seems to get listed in Vista - i've recorded 60,000 errors in the 3 months i've been on Vista!

Just look around for anything logged around the time you get the crashes... or if your feeling daring, crash it, reboot and look at the latest logs.

 

Security Event Log flooded with 4656 Events

We are having issues with our Security event log within Event Viewer. It is my understanding when you perform Object Access auditing and enable it within Group Policy, you still need to enable auditing on the Objects (to be audited) themselves. We just enabled
Object Access auditing and are already seeing Handle Manipulation events (i.e. event id 4656) flooding our Security log even though we have not configured auditing at the file level for ANY of the files in question.
A lot of forums mention disabling Audit File System and Audit Handle Manipulation events to ensure the 4656 events do not flood the Security log; however, we want to be able to see these events for the files that we configure auditing for (at the
file level), but not for any other files which were not configured for auditing at the file level.
We do not have Global Object Access Auditing configured.

 

Hard Disk Failure : Event ID 13150

Hi there,

I am constantly getting the error below. I have performed the checks listed below on this SAMSUNG HD502HJ ATA Device

• a scandisk, no errors found or fixed
• downloaded the disk tools from the manufacturer samsung/Seagate.

Can you please help me understand, whether there is actually a problem. Up until the Windows 10 installation it has never missed a beat.

Your helpw ould be much appreciated.

Log Name: System

Source: disk

Date: 17/11/2015 6:31:28 AM

Event ID: 52

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: Media

Description:

The driver has detected that device \Device\Harddisk0\DR0 has predicted that it will fail. Immediately back up your data and replace your hard disk drive. A failure may be imminent.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="disk" />

<EventID Qualifiers="32772">52</EventID>

<Level>3</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2015-11-16T19:31:28.424878500Z" />

<EventRecordID>13150</EventRecordID>

<Channel>System</Channel>

<Computer>Media</Computer>

<Security />

</System>

<EventData>

<Data>\Device\Harddisk0\DR0</Data>

<Binary>0E00030001000000000000003400048002000000000000000000000000112D000000000000000000000000</Binary>

</EventData>

</Event>