Retention method for security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the security log.

If you do not archive the security log, specify Overwrite events as needed.

If you archive the log at scheduled intervals, specify Overwrite events by days and specify the appropriate number of days in the retain security log setting. Make sure the Maximum security log size is large enough to accommodate the interval.

If you must retain all the events in the log, select Do not overwrite events. This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events will be discarded.

Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.