Windows 11 22H2 version - Issue with Security Log Full

Question

User gets "Security Log Full" error. We go in and clear and reset back to default to "Overwrite events as needed (oldest events first)

For some reason it is being changed to "Do not overwrite events (clear logs manually).

There are multiple threads on this, however no permanent fix. This is becoming a problem as we began to roll out Windows 11. There is no way we can clear the logs and reset for this many users.

This is what we are seeing::

Answer 1

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to Security logs getts fulled.

I have also found similar issues from other users : https://learn.microsoft.com/en-us/answers/questions/1085762/why-obtain-the-security-log-on-this-system-is-full

As a Workground :

Set Event Viewer set to Overwrite.

Press Windows + R -> Type gpedit.msc -> Go to Computer Configuration > Administrative Templates > Windows Component > Event Log Service > Security > Control Event Log Behavior when the log file reaches its maximum size, Set it to Disable -> Reboot your computer.

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

has anyone tried 'configure log access' and enabling it?

gpedit.msc -> Go to Computer Configuration > Administrative Templates > Windows Component > Event Log Service > Security > configure log access

and then setting log access to regular users or everyone in gpo? would that be a workaround?

i haven't tried it on anything but that setting did seem interesting