Why obtain "The security log on this system is full" after install Win11 22H2

Anonymous

In the most recent laptops that I installed the latest update of Windows 11 (22H2) every so often that I restart the computer I get the message "The security log on this system is full". I enter the event viewer with another credentials and choose the "Overwrite events" option but after a while it doesn't allow me to log in showing the same previous message and changing back to the "don't overwrite events" option.

Mitchel T. Erb 1 Reputation point

2022-12-05T14:23:01.317+00:00

Having similar issues where the Overwrite security logs keeps reverting causing non-privileged users not to be able to login to their machines. All users with the issue are on 22H2...fun times.
ARUN K 0 Reputation points

2023-01-12T17:49:24.9866667+00:00

Getting the same issue.If anybody have a fix please provide.
Stefan 0 Reputation points

2023-07-12T11:45:51.6666667+00:00

Having this same issue on a new Windows 11 Surface.

We've cleared the logs, increased the maximum log size, and changed the settings to "Overwrite event as needed (oldest vents first)", but it just keeps reverting to "Do not overwrite events (Clear logs manually)".

We've also carried out a clean install of Windows and applied the latest updates, but the issue keeps resurfacing.

Really need a lasting fix as this new Surface is all but unusable for the end user.

30 answers

Wesley Li-MSFT 4,651 Reputation points Microsoft External Staff

2022-11-16T03:28:04.29+00:00

Hello

You can try to check if you have the following policy enabled：
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security audits
If so, please consider disabling the policy.

You can also clear log, increase the maximum log size or let it overwrite older entries. Refer to: Start --> Run --> EVENTVWR.MSC --> Right click Security log, go to Properties. Then, you can clear log, increase maximum log size or choose “Overwrite events as needed (oldest events first).

Best Regards,
Wesley Li
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Armin 21 Reputation points

2022-11-30T08:07:17.753+00:00

Hi there,

we do have the same problem on different Computers with Win11 22H2. Regardless of the settings we make in even log's properties, the settings switch back to "do not overwrite" when the computer reboots. As a result the user cannot log it.
Any other ideas?

Armin
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Darrelle Alexander 1 Reputation point

2022-11-30T16:40:29.767+00:00

We are also experiencing this error on our domain. So far, we've identified four machines with the issue, all running 22H2 (one was a clean install and the other three were upgrades). I think it's safe to say at this point that Microsoft needs to look into this. The fix posted does not apply to us; our domain functionality level is 2016 and we do not have that policy enabled on our DCs. I also came across a reddit post that had the same issue where they resolved it by upgrading their domain level to 2022, but that should not be a fix for a problem that clearly was introduced by 22H2. All of the machines were running 21H2 and had no issues until upgrading to 22H2 within the last two weeks, so something has triggered this for systems that are domain joined.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Armin 21 Reputation points

2022-12-05T14:56:14.613+00:00

Hi,
as a workaround I've configured a GPO for the settings of security event log and applied it to the affected machines. This seems to work.
However I agree that this is something Microsoft should look into.
Was this answer helpful?

4 people found this answer helpful.
John J 16 Reputation points

2022-12-15T17:05:41.793+00:00

Hi Armin,

Can you write a little more about what GPO settings you configured? I already had retention set to overwrite at 7 days, but my single Windows 11 22H2 workstation continues to revert to "Do not overwrite events"

Babalola Deen 0 Reputation points

2023-09-19T15:05:21.7866667+00:00

Hi, please can you work me through how the GPO was created. and applied. I am fairly new in windows environment. I know to clear it manually and also to increase the log size. but using GPO will be a good work around.

Armin 21 Reputation points

2023-09-19T15:48:17.23+00:00

Hi, I've created the GPO on an Domain-Controller of our companies Active Directory domain.

Her is a tutorial to create a GPO if you have an Active Directory:

https://www.windows-active-directory.com/create-enable-disable-gpo.html

Here is a tutorial if you do not have an Active Directory but want to make the setting ion your local computer only:

https://www.howtogeek.com/736545/how-to-open-the-group-policy-editor-on-windows/

The setting I configured was

Computer Configuration -> Policies -> Windows Settings -> Security Settings ->Event Log

MaximumLogSize = 40960 (Size in kilobytes, you my chose a different value)

AuditLogRetentionPeriod = As needed (will be set to 0)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Hitesh Chaudhary 6 Reputation points

2022-12-20T17:08:10.137+00:00

Hi All,

I am also experiencing the same issue with the new laptops we setup which are practically Windows 11 out of the box.

One thing I found out as a Fix is that if you set the following group policy to Disabled and do a gpupdate /force it changes to Overwrite events as needed on event viewer.

Go to Edit Group policy on the target computer

Select Computer Configuration > Administrative Templates > Windows Component > Event Log Service > Security > Control Event Log Behavior when the log file reaches its maximum size, Ser it to Disable.

For now my log size is 100096KB and is already reached to its maximum size but still the option on my Event Viewer is set to Overwrite events as needed with the above change I made.

Please try the Fix I suggested and let me know the results.
Was this answer helpful?

1 person found this answer helpful.
YusufKhan-1951 1 Reputation point

2023-01-25T10:32:55.76+00:00

Hi Hitesh,

I agree with your solution it works for workgroup machines if any GPO is deployed on domain machines for controlling these settings.

it's not working because GPO overwrites manual GPO settings.

We are also facing this issue let's explain the issue:

In the windows version, 22H2 GPO is not working because it's creating log files not the expected size during the duration of archiving time.

In Our infra we set GPO

Security logs file size: 512 MB

By days: 7 days.

now the logs file size reached 512 MB before 7 days and the mark doesn't override settings in the event viewer.

After updating policies.

Hitesh Chaudhary 6 Reputation points

2023-03-13T14:16:04.8333333+00:00

Hi Yusuf Khan,

Thank you for your feedback on my solution.

I have the same issue, and when I found out this solution I applied on mine first and for past 4 months I havent faced this issue and my settings are still on Overwrites events as needed. My device is domain joined.

We also have same GPO settings on domain.

Please try the solution again and let me know how it works for you.

Thanks

Hitesh

Babalola Deen 0 Reputation points

2023-09-19T15:07:55.1833333+00:00

I have tried above, and I will keep an eye out for it if it works.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Why obtain "The security log on this system is full" after install Win11 22H2

30 answers

Your answer