none
Event log retention not setting through GPO

    Pregunta

  • I'm trying to set the maximum log file size and the retention policy for the event logs via GPO.  The maximum size policy works just fine, but the retention policy isn't changing when I update group policy.  I ran gpresult and I see the settings in there, and no other settings that seem to conflict, but when I go to the properties of the event log it's still showing the old setting.  Any ideas?

    Thanks!
    martes, 05 de abril de 2011 22:07

Todas las respuestas

  • Hi,

    According the issue , I recommend that  you may check the registry after the group policy was updated.

    Here is a example for system log retention in registry:

    1.       Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog, chose the system.

    2.       Check the values of the DWord ---- “Retention” and “AutoBackupLogfiles” by following:

     

     

    Overwrite events as need

    Archive the log when full,do not overwrite events

    Do not overwrite events

    Retention

    0x0000000

    0x0000001

    0x0000000

    AutoBackupLogfiles

    0x0000000

    0xffffffff

    0xffffffff

     

    If the value has no change, please check whether the GPO  in other computer could come into effect.

     

    Hope that helps

    • Marcado como respuesta Miya YaoModerator miércoles, 27 de abril de 2011 8:06
    • Desmarcado como respuesta Teleute00 miércoles, 27 de abril de 2011 15:15
    lunes, 11 de abril de 2011 6:44
  • Before I posted originally, I did check, and the the value is not being set (either in the properties or in the registry...would those values ever be different??).  And as I mentioned in the original post, I checked other GPOs for conflicts and there are none that even remotely seem applicable (we're actually running very little group policy right now).
    miércoles, 27 de abril de 2011 15:17