Re: GPO causing client security logs to fill?


"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:77D4DADD-7CA0-482B-A538-8F5FFFC805C1@xxxxxxxxxxxxxxxx
On our SBS2003 network the security logs on several of our clients are
filling quickly. This is causing a problem where users can't logon because
they receive an error indicating that "the security log is full and only
the
admin can logon to fix the problem".
This began after a change was made to
the group policies.

Do you know what exactly those changes were?

It appears that the two most problematic computers are those that are
logged
into from other computers. Specifically, one of them has a printer
attached
and the other is a server for our accounting program.

The event ID's are as follows 515, 528, 538, 540, 552, 576, 680, 858

When I view the event logs through server management the properties for
the
security event log indicate that it is to overwrite messages older than 7
days. In one case the log is full with only two days worth of events. Of
course this is the PC that is the accounting server.

I assume that this is as a result of a GPO change. I also assume that with
the change either the log clearing properites were unknowingly changed or
a
change was made with regard to what is recorded in the log. Unfortunately,
I
don't really know what items to look at or which ones are safe to change.

All event logs should be set to a decent size (about 20MB at minimum, more
on the server esp for app/system), and set for "overwrite as needed".

This can be controlled via GPO -

computer config\windows settings\security settings\event log

....but I'd run an rsop.msc on one of the problem computers to see what's
been set, and from where.



.

Relevant Pages

  • Re: GPO causing client security logs to fill?
    ... This is causing a problem where users can't logon ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO causing client security logs to fill?
    ... Settings/Security Settings/Event Log/Maximum Security Log Size was not set ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
    (microsoft.public.windows.server.sbs)
  • RE: Accessing eventlogs remotely on W2K3 Server
    ... guest access to application Log" and "Restrict guest access to system ... Another solution - save event logs in database and provide web-based ... Accessing eventlogs remotely on W2K3 Server ... (minus the security log). ...
    (Focus-Microsoft)
  • Re: GPO causing client security logs to fill?
    ... Settings/Security Settings/Event Log/Maximum Security Log Size was ... into from other computers. ... When I view the event logs through server management the ... All event logs should be set to a decent size (about 20MB at ...
    (microsoft.public.windows.server.sbs)
  • Accessing eventlogs remotely on W2K3 Server
    ... (minus the security log). ... This is easy to do in W2K server by having them use the run as command ... must be a local admin on the server to view event logs remotely. ...
    (Focus-Microsoft)