Windows Security Log Event ID 1104

1104: The security Log is now full

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

No more events will be logged until the log is expanded, cleared or configured to overwrite events.

This event indicates a "hole" in your audit trail and should be avoided with the implementation of an effective log management solution that collects events before they can be overwritten or before the log fills up.

"Do not overwrite events (clear log manually)" should only be used in conjunction with the security option "Audit: Shutdown system immediately if unable to log security audits".  Of course these 2 settings together will cause the system outages if the log is allowed to fill up and would only be appropriate for systems with the highest integrity requirements on audit trails.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

Mini-Seminars Covering Event ID 1104 Building a Security Dashboard for Your Senior Executives

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy