Event Viewer log sizes default

[Brandon Moser]

I have changed my settings on all of my Event Logs as according to the
Hardening Guide from MS, but everytime I go back and look at them, they have
defaulted to 1024K. Is there a restriction on the size? According to MS I am
supposed to be able to set them higher. Does anyone know of a bug or reason?
Also, they are set to "overwrite as necessary" and the setting is changing
to "Clear Manually". Could this be a setting in a GPO?

OS: W2K Srv - SP4

TIA,

 

[Jerold Schulman]

I have changed my settings on all of my Event Logs as according to the
Hardening Guide from MS, but everytime I go back and look at them, they have
defaulted to 1024K. Is there a restriction on the size? According to MS I am
supposed to be able to set them higher. Does anyone know of a bug or reason?
Also, they are set to "overwrite as necessary" and the setting is changing
to "Clear Manually". Could this be a setting in a GPO?

OS: W2K Srv - SP4

TIA,

Make sure that the built-in System Account has full control permissions on the
..evt files at %systemroot%\system32\config


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com