Question

Locked

Event Viewer - Security

By Baltierra ·
Ok, so I have Win 2003 Standard server. I log in remote and I get "Security Log Full" I go into the security log and clear it. I then set it "overwrite events as needed" click ok and everything seems ok. I then log in later and it give me the same error. Also, my setting for my even viewer go back to "overwirte events older then blank"

any advise appericated.

Thanks

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Try this script

by IC-IT In reply to Event Viewer - Security

Copy this into notepad and save it as a VBS file. It should be ran from a local admin account and will set the log size at 2.5MB, overwrite to 14 days. You may change the log size and or overwrite time. Hopefully if it stays set, you may then try to manually set it to overwrite as needed.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile")
For each objLogfile in colLogFiles
strLogFileName = objLogfile.Name
Set wmiSWbemObject = GetObject _
("winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2:" _
& "Win32_NTEventlogFile.Name='" & strLogFileName & "'")
wmiSWbemObject.MaxFileSize = 2500000000
wmiSWbemObject.OverwriteOutdated = 14
wmiSWbemObject.Put_
Next

Collapse -

Group Policy?

by Stizzed In reply to Event Viewer - Security

Is it possible that you have a Group Policy overriding your manual changes?

Try entering "rsop.msc" in start/run to see what policy settings show for event logs.

Good Luck!

Back to Networks Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums