The security log on this system is full. Only administrators can sign

Hi there!

I prepared 2 Windows 11 computers. I can login to computers as an administrator fine but when users try to login, they get the following message:

The security log on this system is full. Only administrators can sign in to fix the problem.

I did some research and found a workaround, basically, going to properties of Security under Event Viewer – Windows logs, clearing the log and selecting the first option, “Overwrite events as needed.”

Please see the attached screenshot.

But after a while, it switches back to: Do not overwrite events.
And users start getting that login message.
Both computers behave this way.

I researched the internet and it seems like no one found a solid solution to this issue.
I was wondering if a script or GPO could be written and run at the log off or restart. Basically this GPO or script will make sure that “Overwrite events as needed.” checked before a user log off or restart the computer.

It seems like when computers get update or a software install, it switches that log to Do not overwrite events..
I was wondering anyone knew how to achieve this with a log off script, GPO or even Task Scheduler. Maybe it just needs to run everyday so that default security log setting stays as it is configured.

This is Windows 11, 23H2

Thanks for any feedback!

This is a known Windows 11 issue (and you're in a Windows 10 forum... try Eleven Forums in future).

However, try using Group Policy to set this machine-wide (rather than per user):

1. Press Windows + R together.

2. Enter gpedit.msc.

3. In the left-hand navigation pane, go to Computer Configuration > Administrative Templates > Windows Components > Event Log Service > Security (a).

4. In the right-hand action pane, select Control Event Log Behavior when the log file reaches its maximum size (b).


5. Change the state from Not configured to Disabled (c) then Apply/OK the change.


6. Close the Group Policy Editor.

7. Reboot your computer so the changes to the registry can be re-read and acted upon.

Note: This is just a workaround until Microsoft takes note of the complaints over the last year about this.

Hope this helps...