The security log is now full (Windows 11 Only)

Hi Muhammad,

Good day! I’m Jhakesong and I'll try to help you today.

Give this Event Viewer settings a try and see if it helps. This should avoid the Security log cache being full.

1. Launch Event Viewer
2. Expand Windows Logs
3. Click Security
4. Look under Actions (Right side portion of the window)
5. Click Properties
6. At the very bottom, Under "when maximum event log size is reached", Select Overwrite events as needed (oldest events first)
7. Click Apply and click Okay.
8. Check if the issue still persists

Let me know how it goes. Have a great day!

I agree; this is STILL an issue. I have implemented 50 Brand New Lenovo P360 PC's with Windows 11 after running ALL updates i get the same exact issue here...Event ID 1104 and I have to reset the darn overwrite EVERYDAY!!! What is the fix Microsoft???

Hi, All,

From what I can tell, the chrome team thinks this is a microsoft issue and the microsoft team thinks this is a chrome issue. aka 'going to take a long time to resolve'. This dynamic means that Microsoft & Google together are creating an alley with no security logging on our company windows machines.

I have been slowly deriving what logging I have to turn off in order to keep our company laptops' security logs from filling up.

Originally: 40MB log files would fill up on computer startup, and then we'd have no security logging at all...unacceptable.

1. I turned off Group Policy to 'audit privilege use'. After this change, logs took 4 hours to fill up.
2. I turned off Group Policy to 'audit policy changes'. After this change, logs look like they will fill up in about 10 days.

Logging these two items is required to achieve DoD security certification, so we're taking a hit here. But having no security logging is worse than incomplete ones.

Our standard is 365 days of logs, so I'll probably keep experimenting with a combination of reducing logging, increasing the log file size, and I may have to introduce a log shipping solution (the latter would be good for our security architecture anyway...)

Thanks for the Respond Mr. JhakeSong.

For this solution, I'm already trying to do this solution but after the next day, it happens again . Is it have any solution to fix this issue?

Thanks.

I've had this start happening since early December. It has now touched 14 clients. a Permanant solution would be nice. The last solution doesn't save any changes (Overwrite events as needed), and a complete new install doesn't fix the issue either.