Windows Server 2022 — Security Event Log Reaches Maximum Size and Stops Auditing — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Quick Checks
3. Deep Diagnosis
4. Primary Fix
5. Verification
6. Prevention & Hardening

Symptom & Impact

Security log fills to maximum and stops recording new events, creating compliance and forensic blind spots. Investigations lose continuity during critical periods. SIEM ingestion may show healthy pipelines but source data is incomplete.

Quick Checks

Inspect current log size, retention mode, and event generation rate by category.

wevtutil gl Security
Get-WinEvent -LogName Security -MaxEvents 20
AuditPol /get /category:*

Deep Diagnosis

Identify noisy audit subcategories and service accounts producing excessive failed logon events.

Get-WinEvent -LogName Security -MaxEvents 500 | Group-Object Id | Sort-Object Count -Descending | Select -First 20
Get-WinEvent -LogName Security -FilterHashtable @{Id=4625} -MaxEvents 200 | Select TimeCreated,Message

Primary Fix

Increase log capacity, set overwrite policy aligned with retention requirements, and reduce noisy audit categories safely.

wevtutil sl Security /ms:1073741824
wevtutil sl Security /rt:true
AuditPol /set /subcategory:'Logon' /success:enable /failure:enable

Verification

Security log should continue writing under load and retention should match policy target duration.

wevtutil gl Security
Get-WinEvent -LogName Security -MaxEvents 50 | Select TimeCreated,Id

Prevention & Hardening

Implement ingestion lag alerts and periodic audit policy reviews to prevent future logging outages.

Get-Counter 'Event LogEvents Logged Persec'
AuditPol /get /category:*
Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.Message -match 'event log'}