The security log is now full (Windows 11 Only)

Anonymous
2022-12-20T07:02:25+00:00

Hi all,

Need your help, all devices that i monitor using windows 11 will hit the error (The security log is now full - Event ID 1104.) Need your advise for solve this problem

Temporary solution

  • I clear log and overwrite in event viewer but still happen back on the next day.

Thanks.

Windows for home | Windows 11 | Accounts, profiles, and login

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Ramesh 181.6K Reputation points Volunteer Moderator
    2023-01-27T16:33:33+00:00

    Yusuf,

    Have you tried the AuditPol command-line on that page to turn off WFP logging, anyway? I think that will help.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2023-02-02T05:36:11+00:00

    Hi Ramesh,

    No, We can't stop WFP logging we need logs for auditing. the problem only comes in Windows 11 Version 22H2,

    Here one thing notable in this version GPO behavior is changed automatically. but same GPO applied on other machines.( 21H2).

    Was this answer helpful?

    0 comments
  3. Anonymous
    2023-02-06T13:52:26+00:00

    This is absolutely REDICILOUS that Microsoft knows this is a MAJOR issue, especially when you a have it on 1 couple HUNDRED Computers....this UPDATE is broken...please fix it....this is a SECURITY Logging issue and we should NOT have to disable anything....

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  4. Anonymous
    2023-02-20T05:19:45+00:00

    Hi Butch,

    Have you received any updates from Microsoft regarding this issue? We're encountering this problem on multiple machines that have been updated to Windows 11 version 22H2. We noticed that WFP logs are also being created on Windows 11 version 21H2, but we're not experiencing any login issues due to the GPO behavior remaining unchanged.

    Our concern is why there are multiple entries being created in the WFP logs on Windows 11. Do you have any insights or suggestions on how to address this?

    Thank you.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2023-02-20T11:46:48+00:00

    Hi, All,

    From what I can tell, the chrome team thinks this is a microsoft issue and the microsoft team thinks this is a chrome issue. aka 'going to take a long time to resolve'. This dynamic means that Microsoft & Google together are creating an alley with no security logging on our company windows machines.

    I have been slowly deriving what logging I have to turn off in order to keep our company laptops' security logs from filling up.

    Originally: 40MB log files would fill up on computer startup, and then we'd have no security logging at all...unacceptable.

    1. I turned off Group Policy to 'audit privilege use'. After this change, logs took 4 hours to fill up.
    2. I turned off Group Policy to 'audit policy changes'. After this change, logs look like they will fill up in about 10 days.

    Logging these two items is required to achieve DoD security certification, so we're taking a hit here. But having no security logging is worse than incomplete ones.

    Our standard is 365 days of logs, so I'll probably keep experimenting with a combination of reducing logging, increasing the log file size, and I may have to introduce a log shipping solution (the latter would be good for our security architecture anyway...)

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments