Retain old events

This policy setting controls Event Log behavior when the log file reaches its maximum size.

When this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost.

When this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events.

Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting.

Supported on: At least Windows Vista

Registry HiveHKEY_LOCAL_MACHINE
Registry PathSoftware\Policies\Microsoft\Windows\EventLog\Security
Value NameRetention
Value TypeREG_SZ
Enabled Value1
Disabled Value0

eventlog.admx

Administrative Templates (Computers)

Administrative Templates (Users)