The security log is now full (Windows 11 Only)

Anonymous
2022-12-20T07:02:25+00:00

Hi all,

Need your help, all devices that i monitor using windows 11 will hit the error (The security log is now full - Event ID 1104.) Need your advise for solve this problem

Temporary solution

  • I clear log and overwrite in event viewer but still happen back on the next day.

Thanks.

Windows for home | Windows 11 | Accounts, profiles, and login

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-09-18T20:27:26+00:00

    I did the following steps below using a GPO to deploy to specific computers in the domain. I haven't had that issues since making the changes in April 2023.

    • Set the Retention for the security log to Overwrite Events as Needed (setting to days to clear no longer works)
    1. Open GPMC and Edit the correct GPO that applies to the OU of the computers
    2. Computer -- Policies -- Windows Settings -- Security Settings -- Event Log
    3. Configure Retention to Overwrite Events as Needed
    • You MUST increase the Maximum Security Log size to 4,194,240 kilobytes.

    Apply the GPO and restart or run gpupdate /force followed by a restart.

    NOTE 01: Some systems required a system file repair for this GPO to take by running sfc /scannow in elevated CMD.

    NOTE 02: Other systems may require a manual Clear of the security logs in the Event Viewer before the settings take.

    I hope this helps.

    • Robert

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. Anonymous
    2023-08-21T09:02:53+00:00

    Hi,

    we have the same problem.

    For now for fix temporarily the issue we increased the log file to 1 gb, set automatic in security property and in cmd (in administrator mode) used this comand:

    for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

    The policy solution is not clean because applies it in all pc (also w10) and every reset.

    Microsoft please after six months the problem should already be fixed.

    It is a big problem because many people are in domain and can be possible that this issue happen when the worker aren't in office.

    Thanks.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2023-05-10T15:39:18+00:00

    Also now seeing this issue in Windows 10 22H2 build. Not always the same PC but random across the whole network

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  4. Anonymous
    2023-04-25T18:30:21+00:00

    The SC command is used toconfigure, query, stop, start, delete, and add system services on the Windows command line. It's run via an elevated command prompt.

    Just looked up "sc command line" in a browser.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  5. Anonymous
    2022-12-21T05:44:45+00:00

    Thanks. Let's restart the event viewer service. Here's how:

    1. Press windows + r
    2. Type services.msc
    3. From the services windows, scroll down and look for Windows Event Log
    4. Right click on it and choose Stop
    5. Once stopped, choose restart.

    Go back to event viewer.

    1. Go to Windows Logs > Security > Properties
    2. Make sure the settings are the same (Overwrite events as needed)
    3. Check if the logs still indicate it is full.

    Let me know what happens next.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments