Retention of Windows server event logs - Precedence of Windows 2008 settings?

Posted on 2012-08-29
Last Modified: 2012-10-18
We need to know which GPO setting takes precedence for retention of Windows server event logs?

As per Technet article
The Windows settings in Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service take precedence over the Windows 2003 settings in  Computer Configuration\Policies\Windows Settings\Security Settings\Event Log. Therefore if we configure the settings as below, according to this precedence rule, the log size will overrule the time rule. What happens therefore if the log reaches its maximum retention time e.g. 90 Days before it reaches the maximum size? Will the log be overwritten as per size settings, or will the Windows 2008 size setting take precedence and continue to grow the log until the maximum size?

Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service (Windows 2008 settings)
Maximum log size  - Enable and set according to MS recommendations
Backup  log automatically when full – Enable (Event Log file is automatically closed and renamed when it is full. A new file is then started)
Retain Old Events (Enable  - When this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost)

Computer Configuration\Policies\Windows Settings\Security Settings\Event Log (Windows 2003 settings)
Maximum Application Log Size (not defined)
Maximum Security Log Size (not defined)
Maximum System Log Size (not defined)
Retain Application Log for 365 Days
Retain Security Log for 90 Days
Retain System Log for 90 Days
Question by:Bethanie
    LVL 39

    Accepted Solution

    Unfortunately these policies do not imply together :/
    When you set up: back up when log is full then it awaits to fill whole log
    Using time it is not aware of log size :/ You need to then ensure if log size is big enough to store whole event logs

    Microsoft suggests to not set up "Retain event logs" policy

    So, you need to ensure which option is much more useful to you :)

    LVL 18

    Assisted Solution

    by:Sushil Sonawane
    The log be overwritten as per size settings becuase domain policy override on local policy.

    These GPOs, once created, are applied in a standard order: LSDOU, which stands for (1) Local, (2) Site, (3) Domain, (4) OU, with the later policies being superior to the earlier applied policies. Local Group Policy Objects are processed first, and then domain policy. If a computer is participating in a domain and a conflict occurs between domain and local computer policy, domain policy prevails. However, if a computer is no longer participating in a domain, local Group Policy is applied.

    Please below article for more information.


    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Join & Write a Comment

    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    Synchronize a new Active Directory domain with an existing Office 365 tenant
    This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
    This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now