The security log is now full (Windows 11 Only)

Anonymous
2022-12-20T07:02:25+00:00

Hi all,

Need your help, all devices that i monitor using windows 11 will hit the error (The security log is now full - Event ID 1104.) Need your advise for solve this problem

Temporary solution

  • I clear log and overwrite in event viewer but still happen back on the next day.

Thanks.

Windows for home | Windows 11 | Accounts, profiles, and login

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2023-03-15T14:11:36+00:00

    Beyond finding out which events are filling up the log, has anyone found a way to have the log keep the "overwrite as necessary" setting?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2023-03-09T15:29:22+00:00

    I have also been experiencing this issue with Windows 11 22H2 systems. Happens on my primary work laptop and my Windows 365 cloud PC which literally has nothing installed.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2023-02-28T14:24:25+00:00

    I have not heard a WORD about this issue yet. I am still having some issues with the PC's getting the error that the security log is full and needs admin to fix...very frustrating. I run a EDR called ThirySeven4 and have Windows Defender and Security Essentials turned off so i am not experiencing issues with the WFP Logs.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2023-02-28T14:08:22+00:00

    We are required to maintain the security log for 365 days. We have had this policy in place since windows 2k- however, the latest patched edition of Windows 11 causes the log file to grow insanely fast. We really need to find a solution to this- because not applying updates is not the solution.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2023-02-20T11:46:48+00:00

    Hi, All,

    From what I can tell, the chrome team thinks this is a microsoft issue and the microsoft team thinks this is a chrome issue. aka 'going to take a long time to resolve'. This dynamic means that Microsoft & Google together are creating an alley with no security logging on our company windows machines.

    I have been slowly deriving what logging I have to turn off in order to keep our company laptops' security logs from filling up.

    Originally: 40MB log files would fill up on computer startup, and then we'd have no security logging at all...unacceptable.

    1. I turned off Group Policy to 'audit privilege use'. After this change, logs took 4 hours to fill up.
    2. I turned off Group Policy to 'audit policy changes'. After this change, logs look like they will fill up in about 10 days.

    Logging these two items is required to achieve DoD security certification, so we're taking a hit here. But having no security logging is worse than incomplete ones.

    Our standard is 365 days of logs, so I'll probably keep experimenting with a combination of reducing logging, increasing the log file size, and I may have to introduce a log shipping solution (the latter would be good for our security architecture anyway...)

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments