Hi ALL, My domain is Windows 2003 native mode. When I create group policy for event log on an OU that contains Windows 7 and Windows XP computer objects. Windows XP client is working without problem but Windows 7 client cannot be applied as expected. However, the group policy had been applied since the settings cannot be edited as well. My Event Log group policy settings is as follows: Maximum application log size: 16384k Maximum security log size: 16384k Maximum system log size: 16384k Retention method for application log: As needed Retention method for security log: As needed Retention method for system log: As needed When I check the properties of the security log in Windows 7, the "Enable logging" check box is dimmed. The Maximum log size (KB) is 20480 and "When maximum event log size is reached" is "Archive the log when full, do not overwrite events. Does anyone out there had encounter the same problem? Any advise is welcome. TIA M C

Hi, Welcome to post in Technet. This issue can be caused by applied policies that override the policy you want to set. I suggest you run the following command in Windows 7 client and check the result of policy applying. gpresult /z > %userprofile%\desktop\gpresult.txt Then on Desktop open the file gpresult.txt and check the result. Arthur Xie TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, The group policy had NOT been overrided as can be proved by running the Resultant Set of Policy on the Windows 7 client. I tried to configure the Retention method for security log as "Not Defined", but the "Enable logging" in the properties of Security log was still be enabled and I could not change the "When maximum event log size is reached to other options, i.e. The selection is reset to "Archive the log when full, do not overwrite events". TIA M C

RSOP works for Windows XP and Windows Server 2003. It is not indicated to be compatible with Windows 7. In order to obtain accurate information regarding GP applying, please run the gpresult command in my previous post and then check the result. You may open gpedit.msc in a Windows 7 client and try to configure related settings. You will find that the minimum size you can set via group policy is 20480. That is why you see 20480 although you have set the size to 16384. Additionally, if you would like to change the retention setting to “Do not overwrite events”, you need to enable “Retain old events” and “Backup Log automatically when full”. You will see related information in the detail of the policies.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Arthur, I know this is answered but just a follow up question... Is there a reason why the Security log is restricted to 20480 yet states you can go as low as 1024? Previously you could set this in the "Security" section and 1024 was allowed. Just curious. I know the older policy is for Windows XP SP2/Server 2003 and the newer stuff is for Server 2008 and Vista and above. You can mix these and the newer version of these settings in administrative templates will take precedence (at least in the case of event logs because I've seen it). I just wanted to elaborate on this point a little and see why the 20480 restriction. Below is the text directly out of the Group Policy setting for Security Log max size This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments. Thanks for any clarification. :)

Hi, We found that the detail information for the policy should have a problem. We will report it to proper department.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.