← 03 — Blog

How far back does your Security log actually reach?

Tooling2 min read

The maximum size of the Security log is a setting. How many hours of history it holds is a measurement, and it changes with load. On a domain controller on Monday morning it can be a fraction of what the same log holds on Sunday. If forwarding to the SIEM stops, that number is all the history you have.

This is a five-minute check. It is read-only and needs an elevated PowerShell.

The check

$log = Get-WinEvent -ListLog Security
$oldest = Get-WinEvent -LogName Security -MaxEvents 1 -Oldest
[pscustomobject]@{
    MaxSizeMB   = [math]::Round($log.MaximumSizeInBytes / 1MB)
    FileSizeMB  = [math]::Round($log.FileSize / 1MB)
    Mode        = $log.LogMode
    Records     = $log.RecordCount
    OldestEvent = $oldest.TimeCreated
    HoursBack   = [math]::Round(((Get-Date) - $oldest.TimeCreated).TotalHours, 1)
}

For several domain controllers at once, wrap the same block in Invoke-Command -ComputerName DC01, DC02 -ScriptBlock { … }. That needs PowerShell remoting to the DCs, which most domains allow for administrators.

Reading the result

  • FileSize is close to MaximumSize. The log is full and overwriting. HoursBack is your real local retention right now.
  • FileSize is well below MaximumSize. The log has not filled up since it was last cleared or resized. HoursBack only tells you when that happened.
  • Mode is Retain. When the log fills up, Windows stops writing new events instead of overwriting old ones. On a server you forward from, that loses the newest events — usually the worse trade.
  • Mode is AutoBackup. Windows archives the full log to a file and starts a new one. History is kept, and so is the disk usage; someone has to clean up the archives.

Run it at your busiest hour. A measurement on a quiet day is the best case, not the typical one.

Fixing a log that reaches back too few hours

Raise the size with Group Policy: Computer Configuration > Policies > Administrative Templates > Windows Components > Event Log Service > Security > Specify the maximum log file size (KB). Measure HoursBack again after a busy day; the relation between size and hours is roughly linear for a given load, so one measurement before and one after tell you what you bought.

A bigger local log is a safety margin, not a substitute for forwarding. It does not survive a disk wipe, and an attacker with administrator rights can clear it, which leaves only 1102 behind.

Takeaway

Write HoursBack from your busiest DC into the local retention field of your log source inventory, with the date and time you measured it. The audit policy check script reports the same number, together with the rest of the audit configuration.