How to disable security logs cleaning?

Question

Hello, I use Windows Server 2022 Datacenter, and I want to disable the clean function for logs. I'd done it for all logs, like Application, System but I can't do it for Security logs.

The command which I used:

wevtutil sl security /ca:"O:BAG:SYD:(A;;0xf0005;;;SY)"

I know that it isn’t good permissions, it just for example.

wevtutil gl security

name: security
enabled: true
type: Admin
owningPublisher:
isolation: Custom
channelAccess: O:BAG:SYD:(A;;0xf0005;;;SY)
logging:
  logFileName: %SystemRoot%\System32\Winevt\Logs\security.evtx
  retention: true
  autoBackup: true
  maxSize: 20971520
publishing:
  fileMax: 1

But after setting permissions I still can clean it.

wevtutil cl security

I'd tried to set perms by the GPO, but nothing changed

Answer 1

Not sure if there is a supported way to prevent it. Maybe the best approach here is to detect when Security log was cleaned.