The security log is now full (Windows 11 Only)

I thought I was the only one experiencing this cascading effect.

I have had multiple NEW PC's do this after initial setup but only a few keep repeating the issue...doing the overwrite and apply has fixed MOST of them but a few resort back to the issue. I am wondering IF the issue may be an update it has installed and the others have not.

Same thing happening in my organization. Has anyone found a solution?

Hi,

We are also facing this issue in the windows 11 update 22H2 machine.

this is an issue related to windows 11 updates.

GPO provisioning is not working as we set it.

For example:

we set a GPO for security logs files size control.

Max size is: 512 MB

Retain security log: 7 days

Retention method for security logs: by days

I am having the same issue on numerous windows 11 laptops, including my own.

I downloaded the security event log (23000 entries/40MB) to csv, open in excel, pivot to find that it filled up on 11/29 with the following messages.

• Event 5447 A Windows Filtering Platform filter has been changed. 63% of messages
• Event 5449 A Windows Filtering Platform provider context has been changed. 28% of messages.
• so 90% of the log problem is 'windows filtering platform'

I found this issue and fix reported years ago, to disable auditing for : https://social.technet.microsoft.com/Forums/en-US/0eac969a-ddee-4e16-a557-23edd00c6fc8/security-log-filling-up-with-event-id-5447-on-windows-2008r2-dc?forum=winserverPN

The interesting bit:

Since event 5447 belong to "other policy change events" audit subcategory.
Run command below to show the audit policy status:
auditpol /get /subcategory:"other policy change events"

Run command below to disable the audit policy:
auditpol /set /subcategory:"other policy change events" /success:disable /failure:disable

If there are more inquiries on this issue, please feel free to let us know.

But things have changed since November...

I expanded the size of the file log file and rebooted a couple of times on 1/25/2023. This time, I'm getting different results.

Each reboot adds 25,000 entries to the log file (about 40MB worth).

The majority (76%) of issues in the log file are 4673, use of sensitive privileges. They all refer to 'teams.exe'.

re. the teams issue, this article may give us an option:

https://learn.microsoft.com/en-us/answers/questions/1144610/event-id-4673-for-teams-exe-and-msedge-exe

The interesting bit:

Here is the information that I wanted to discuss with you today:
After researching the issue, my team and I have found that this is a known issue that is not unique to Teams or Edge. This issue occurs with Chrome and Chromium applications. The issue occurs with Chromium-based applications if their default configurations are changed. 

At this time, there are three options to move forward:

1. You can permit SeProfileSingleProcessPrivilege for users.
2. You can disable the failure audits.
3. You can continue to monitor with the high volume of events being generated.