Re: GPO causing client security logs to fill?

LDD15 <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Do you have any idea why this would have changed? We have had this
system set up for several years and never had this issue. As I
mentioned, I had to make a policy change the other day and I'm sure
it results from that.

But what *was* the change you made??

What bothers me is that if this policy, Computer Config/Windows
Settings/Security Settings/Event Log/Maximum Security Log Size was
not set before then why is it a problem now? Is it that there are
more events and if so why or more specifically is there a security
issue?

It's hard to say, but yes, it sounds like there are more events. You really
will need to provide more detail, I'm afraid.

"Lanwench [MVP - Exchange]" wrote:


"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:152CF5A9-7EAE-479D-A9B7-9DBF1409859A@xxxxxxxxxxxxxxxx
rsop.msc shows eventlog settings as not defined. So is the 512kb a
windows default?

I guess so. I always tweak mine so I can't look anything up from
here.


"Lanwench [MVP - Exchange]" wrote:


"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:77D4DADD-7CA0-482B-A538-8F5FFFC805C1@xxxxxxxxxxxxxxxx
On our SBS2003 network the security logs on several of our
clients are filling quickly. This is causing a problem where
users can't logon because
they receive an error indicating that "the security log is full
and only
the
admin can logon to fix the problem".
This began after a change was made to
the group policies.

Do you know what exactly those changes were?

It appears that the two most problematic computers are those that
are logged
into from other computers. Specifically, one of them has a printer
attached
and the other is a server for our accounting program.

The event ID's are as follows 515, 528, 538, 540, 552, 576, 680,
858

When I view the event logs through server management the
properties for the
security event log indicate that it is to overwrite messages
older than 7
days. In one case the log is full with only two days worth of
events. Of
course this is the PC that is the accounting server.

I assume that this is as a result of a GPO change. I also assume
that with
the change either the log clearing properites were unknowingly
changed or
a
change was made with regard to what is recorded in the log.
Unfortunately,
I
don't really know what items to look at or which ones are safe to
change.

All event logs should be set to a decent size (about 20MB at
minimum, more
on the server esp for app/system), and set for "overwrite as
needed".

This can be controlled via GPO -

computer config\windows settings\security settings\event log

....but I'd run an rsop.msc on one of the problem computers to see
what's been set, and from where.



.

Relevant Pages

  • Re: GPO causing client security logs to fill?
    ... What bothers me is that if this policy, ... into from other computers. ... When I view the event logs through server management the ... All event logs should be set to a decent size (about 20MB at ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO causing client security logs to fill?
    ... they receive an error indicating that "the security log is full and only ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO causing client security logs to fill?
    ... Settings/Security Settings/Event Log/Maximum Security Log Size was not set ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
    (microsoft.public.windows.server.sbs)
  • RE: Accessing eventlogs remotely on W2K3 Server
    ... guest access to application Log" and "Restrict guest access to system ... Another solution - save event logs in database and provide web-based ... Accessing eventlogs remotely on W2K3 Server ... (minus the security log). ...
    (Focus-Microsoft)
  • Re: Computers Kicked off of Domain
    ... The computers are able to login locally ... Event logs give you any clues on the workstations & server? ... no public DNS server IP listed in *any* server or computer's ipconfig. ...
    (microsoft.public.windows.server.general)
Loading