Windows Security Log Event ID 1104

1104: The security Log is now full

On this page

• Description of this event
• Field level details
• Examples

No more events will be logged until the log is expanded, cleared or configured to overwrite events.

This event indicates a "hole" in your audit trail and should be avoided with the implementation of an effective log management solution that collects events before they can be overwritten or before the log fills up.

"Do not overwrite events (clear log manually)" should only be used in conjunction with the security option "Audit: Shutdown system immediately if unable to log security audits".  Of course these 2 settings together will cause the system outages if the log is allowed to fill up and would only be appropriate for systems with the highest integrity requirements on audit trails.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

Mini-Seminars Covering Event ID 1104 Building a Security Dashboard for Your Senior Executives

 

Upcoming Webinars AI Usage by Employees: Understand the Risks and Mitigations Before Choosing What to Do About It Identifying the Tier 0 Assets in Your Active Directory Environment is Step #1 in ITDR

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy