The security log is now full (Windows 11 Only)

I am having the same issue on numerous windows 11 laptops, including my own.

I downloaded the security event log (23000 entries/40MB) to csv, open in excel, pivot to find that it filled up on 11/29 with the following messages.

• Event 5447 A Windows Filtering Platform filter has been changed. 63% of messages
• Event 5449 A Windows Filtering Platform provider context has been changed. 28% of messages.
• so 90% of the log problem is 'windows filtering platform'

I found this issue and fix reported years ago, to disable auditing for : https://social.technet.microsoft.com/Forums/en-US/0eac969a-ddee-4e16-a557-23edd00c6fc8/security-log-filling-up-with-event-id-5447-on-windows-2008r2-dc?forum=winserverPN

The interesting bit:

Since event 5447 belong to "other policy change events" audit subcategory.
Run command below to show the audit policy status:
auditpol /get /subcategory:"other policy change events"

Run command below to disable the audit policy:
auditpol /set /subcategory:"other policy change events" /success:disable /failure:disable

If there are more inquiries on this issue, please feel free to let us know.

But things have changed since November...

I expanded the size of the file log file and rebooted a couple of times on 1/25/2023. This time, I'm getting different results.

Each reboot adds 25,000 entries to the log file (about 40MB worth).

The majority (76%) of issues in the log file are 4673, use of sensitive privileges. They all refer to 'teams.exe'.

re. the teams issue, this article may give us an option:

https://learn.microsoft.com/en-us/answers/questions/1144610/event-id-4673-for-teams-exe-and-msedge-exe

The interesting bit:

Here is the information that I wanted to discuss with you today:
After researching the issue, my team and I have found that this is a known issue that is not unique to Teams or Edge. This issue occurs with Chrome and Chromium applications. The issue occurs with Chromium-based applications if their default configurations are changed. 

At this time, there are three options to move forward:

1. You can permit SeProfileSingleProcessPrivilege for users.
2. You can disable the failure audits.
3. You can continue to monitor with the high volume of events being generated.

Hey yall,

Only thing found from my MSP

The fix I have found is to open gpedit.msc and apply the local group policy for the following.

Select
Computer Configuration > Administrative Templates > Windows Component
> Event Log Service > Security > Control Event Log Behavior when the
log file reaches its maximum size, Set it to Disable.

My latest workaround is using

sc create ClearLog binpath= "wevtutil cl Security"

to create a service that I set to automatic, so that a reboot clears the log -- enabling login.

Not good practice in general, but no one around here seems to reboot other than when applying patches anyway.

Below is the fix that worked for me. The Windows 11 2022 22H2 update caused a break in the settings when upgrading from Windows 10 to Windows 11 with corrupt system files and disabling the retention settings set by days.

• Set the Retention for the security log to Overwrite Events as Needed (setting to days to clear no longer works)

1. Open GPMC and Edit the correct GPO that applies to the OU of the computers
2. Computer -- Policies -- Windows Settings -- Security Settings -- Event Log
3. Configure Retention to Overwrite Events as Needed

• You may want to increase the Maximum Security Log size to 4,194,240 kilobytes.

Apply the GPO and restart or run gpupdate /force followed by a restart.

NOTE 01: Some systems required a system file repair for this GPO to take by running sfc /scannow in elevated CMD.

NOTE 02: Other systems may require a manual Clear of the security logs in the Event Viewer before the settings take.

I hope this helps.

• Robert

This is absolutely REDICILOUS that Microsoft knows this is a MAJOR issue, especially when you a have it on 1 couple HUNDRED Computers....this UPDATE is broken...please fix it....this is a SECURITY Logging issue and we should NOT have to disable anything....