Networks

Ask something
Question Locked

Event Viewer - Security

0 helpful
3 replies

by baltierra

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok, so I have Win 2003 Standard server. I log in remote and I get "Security Log Full" I go into the security log and clear it. I then set it "overwrite events as needed" click ok and everything seems ok. I then log in later and it give me the same error. Also, my setting for my even viewer go back to "overwirte events older then blank"

any advise appericated.

Thanks

3 replies

by ic-it

Copy this into notepad and save it as a VBS file. It should be ran from a local admin account and will set the log size at 2.5MB, overwrite to 14 days. You may change the log size and or overwrite time. Hopefully if it stays set, you may then try to manually set it to overwrite as needed.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile")
For each objLogfile in colLogFiles
strLogFileName = objLogfile.Name
Set wmiSWbemObject = GetObject _
("winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2:" _
& "Win32_NTEventlogFile.Name='" & strLogFileName & "'")
wmiSWbemObject.MaxFileSize = 2500000000
wmiSWbemObject.OverwriteOutdated = 14
wmiSWbemObject.Put_
Next

by stizzed

Is it possible that you have a Group Policy overriding your manual changes?

Try entering "rsop.msc" in start/run to see what policy settings show for event logs.

Good Luck!

This discussion is closed to new replies.