The security log is now full (Windows 11 Only)

I've been seeing this across quite a number of Windows 11 devices for months and haven't been able to find a lasting fix as of yet. While not ideal, my temporary fix is running the following PowerShell script daily against the Windows 11 devices. It backups up the Security logs and then clears them:

$Log = "Security"

$Log_Path = "C:\Windows\Logs"

if (!(Test-Path -Path $Log_Path))

{

*New-Item -ItemType directory -Path $Log\_Path*

}

$logdate = Get-Date -format yyyyMMddHHmm

$destination = $Log_Path + $Log + $logdate + ".evtx"

Write-Host "Backing up $log log."

wevtutil epl $log $destination

Write-Host "Clearing the $log file from Event Viewer."

WevtUtil cl $log

I do this process almost weekly. The settings don't stick.

Hi Muhammad,

Good day! I’m Jhakesong and I'll try to help you today.

Give this Event Viewer settings a try and see if it helps. This should avoid the Security log cache being full.

1. Launch Event Viewer
2. Expand Windows Logs
3. Click Security
4. Look under Actions (Right side portion of the window)
5. Click Properties
6. At the very bottom, Under "when maximum event log size is reached", Select Overwrite events as needed (oldest events first)
7. Click Apply and click Okay.
8. Check if the issue still persists

Let me know how it goes. Have a great day!

I'm experiencing the same thing. Except when I change the settings to what you suggested, it reverts back to the original settings for some reason.

I did the following steps below using a GPO to deploy to specific computers in the domain. I haven't had that issues since making the changes in April 2023.

• Set the Retention for the security log to Overwrite Events as Needed (setting to days to clear no longer works)

1. Open GPMC and Edit the correct GPO that applies to the OU of the computers
2. Computer -- Policies -- Windows Settings -- Security Settings -- Event Log
3. Configure Retention to Overwrite Events as Needed

• You MUST increase the Maximum Security Log size to 4,194,240 kilobytes.

Apply the GPO and restart or run gpupdate /force followed by a restart.

NOTE 01: Some systems required a system file repair for this GPO to take by running sfc /scannow in elevated CMD.

NOTE 02: Other systems may require a manual Clear of the security logs in the Event Viewer before the settings take.

I hope this helps.

• Robert

Thank you very much, it helped.

as instructed settings has been changed but again issue occurred again & again.