The security log is now full (Windows 11 Only)

Anonymous
2022-12-20T07:02:25+00:00

Hi all,

Need your help, all devices that i monitor using windows 11 will hit the error (The security log is now full - Event ID 1104.) Need your advise for solve this problem

Temporary solution

  • I clear log and overwrite in event viewer but still happen back on the next day.

Thanks.

Windows for home | Windows 11 | Accounts, profiles, and login

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2023-01-27T13:42:49+00:00

    Thanks, George,

    Your information is helpful! we are also investigating the security logs files and find 90% of the log problem is 'Filtering Platform Connection' event id 5156 is generating.

    Can you explain to me what the cause is it's happening in only windows 11 and GPO behavior also changed?

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Ramesh 181.6K Reputation points Volunteer Moderator
    2023-01-27T13:48:49+00:00

    Hi Yusuf,

    Maybe you have installed Malwarebytes (or a similar security program) and enabled the Brute Force option? Anyway, you may want to check out Disable “Filtering Platform Connection” (Event ID 5156, 5158) Security Logging

    Was this answer helpful?

    0 comments
  3. Anonymous
    2023-01-27T13:52:15+00:00

    Hi, Yusuf,

    I don't work for microsoft, just a fellow user trying to figure out what is wrong, sharing data so maybe we can figure this out as a community... I have no insight into what MS did/what's causing this.

    George

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2023-01-27T16:17:34+00:00

    Hi Ramesh,

    We are using Microsoft Defender for endpoints. the issue come in only Windows 11 22H2 version.

    The behavior of GPO also changed in this version.

    In windows 11 21H2 behavior of GPO is not changing.

    We set GPO settings as "overwrite event as needed"

    it's automatically changed from overwrite event as needed to "do not overwrite events"

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  5. Anonymous
    2023-01-27T16:27:14+00:00

    Hi George,

    We can find the root cause also as you mentioned "sharing data so maybe we can figure this out as a community"

    Hope it's resolved soon..

    Was this answer helpful?

    0 comments