The security log is now full (Windows 11 Only)

Anonymous
2022-12-20T07:02:25+00:00

Hi all,

Need your help, all devices that i monitor using windows 11 will hit the error (The security log is now full - Event ID 1104.) Need your advise for solve this problem

Temporary solution

  • I clear log and overwrite in event viewer but still happen back on the next day.

Thanks.

Windows for home | Windows 11 | Accounts, profiles, and login

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2023-03-27T23:37:43+00:00

    The GPO setting doesn't work. The first Windows 11 update (which are automatic on our machines) and it resets back to "Do not overwrite".

    I made a daily scheduled task to run "wevtutil cl Security" to clear the Security log using a network admin, but that doesn't seem to work either.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2023-04-14T14:51:05+00:00

    Below is the fix that worked for me. The Windows 11 2022 22H2 update caused a break in the settings when upgrading from Windows 10 to Windows 11 with corrupt system files and disabling the retention settings set by days.

    • Set the Retention for the security log to Overwrite Events as Needed (setting to days to clear no longer works)
    1. Open GPMC and Edit the correct GPO that applies to the OU of the computers
    2. Computer -- Policies -- Windows Settings -- Security Settings -- Event Log
    3. Configure Retention to Overwrite Events as Needed
    • You may want to increase the Maximum Security Log size to 4,194,240 kilobytes.

    Apply the GPO and restart or run gpupdate /force followed by a restart.

    NOTE 01: Some systems required a system file repair for this GPO to take by running sfc /scannow in elevated CMD.

    NOTE 02: Other systems may require a manual Clear of the security logs in the Event Viewer before the settings take.

    I hope this helps.

    • Robert

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  3. Anonymous
    2023-04-14T15:52:33+00:00

    So, to confirm. You've applied patches since your fix, and your local overwrite was NOT reset?

    (As stated, your fix doesn't work for me, but I'm wondering how consistent it it)

    Was this answer helpful?

    0 comments
  4. Anonymous
    2023-04-24T18:39:26+00:00

    I love Microsoft, I really do, but how is there still an unknown solution for this issue? My COO is having trouble understanding why a simple thing causes a multitude of hindrances to productivity.

    Any permanent solution that has been found?

    Was this answer helpful?

    0 comments
  5. Anonymous
    2023-04-24T18:48:44+00:00

    My latest workaround is using

    sc create ClearLog binpath= "wevtutil cl Security"

    to create a service that I set to automatic, so that a reboot clears the log -- enabling login.

    Not good practice in general, but no one around here seems to reboot other than when applying patches anyway.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments