question

Nowtside-5323 avatar image
0 Votes"
Nowtside-5323 asked JennyFeng-MSFT commented

Unable to find event id 1103 after filling up security log, Only event 1104 shows up.

My goal is to create a task attached to event 1103 that warns users when the event log is about to become full. According to this website https://kb.eventtracker.com/evtpass/evtPages/EventId_1103_Microsoft-Windows-Eventlog_64965.asp this event is supposed to show up after the security log reaches a certain treshold.

Does this event even exist? If so how do i find it or force it to show up when my security log fills up? Alternatively is there any other way of accomplishing this task?

windows-10-security
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Nowtside-5323
Hi,

Just checking in to see if the information provided was helpful.

If the reply helped you, please remember to accept as answer.
If no, please reply and tell us the current situation in order to provide further help.

0 Votes 0 ·

1 Answer

JennyFeng-MSFT avatar image
0 Votes"
JennyFeng-MSFT answered

@Nowtside-5323
Hi,
I did not find more information about event ID 1103, it seems to apply to server 2008.
While event ID 1104 applies to windows10, if the maximum size of Security Event Log file was reached and event log retention method is: “Do not overwrite events (Clear logs manually)”.
For your reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104

Hope above information can help you.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.