Set retention for Applications and Services logs in Windows 2008/2012 using the registry

tmlaugle
tmlaugle used Ask the Experts™
on
I need to set the retention for one of the logs in the Applications and Services Logs section of Event Viewer for ALL my servers.  This means I need to do it via a preferences registry setting in group policy.

When I made the retention setting for the Windows logs, I was able to add a Value named Retention in the key for the log, for example:  HKLM\System\CurrentControlSet\Services\EventLog\Application --> Retention = 0 (REG_DWORD).  (Yes, I know I could have done this through Administrative Tools, I chose to do it through the registry.)

I know the location of the Applications and Services Logs in the registry:  HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels --> <name of the log>.  What I am trying to find out is the name of the value to add.  Will "Retention" work here, as it does for the Windows logs?  Or is there a different Value for these logs?  Any help will be much appreciated.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Security and Infrastructure Engineer
Commented:
Retention is the name of the value.
When I tested this just now using
wevtutil sl <log name> /rt:true

Open in new window

the value assigned to Retention was 0xffffffff
This gets changed to 0 if I disable retention.
Seth SimmonsSr. Systems Administrator

Commented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial