Event log policies

Question

Hello all, Kindly explain how to use the AuditLogRetentionPeriod and RetentionDays as shown in the attached link

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b9673a7-ce0a-49b4-912b-591efdb37cdf

Answer 1

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to event log.

AuditLogRetentionPeriod:

0: Overwrite events as needed. This means that when the log reaches its maximum size, the oldest events will be overwritten by new events.

1: Overwrite events as specified by the RetentionDays entry. This means that events will be retained for a specific number of days before being overwritten.

2: Never overwrite events. This means that events will not be overwritten, and the log must be cleared manually when it reaches its maximum size.

RetentionDays: the number of days that events in the System, Security, and Application logs must be retained before being overwritten.

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it