Search code examples
powershelllogginggroup-policy

Set Event Log settings via GPO


How would I set the "overwrite as needed" setting on Event logs other than Application/Security/System? Specifically I'd like to apply this to the Powershell and Windows Powershell Logs, in addition to any other future logs that may be added. This needs to be applied to both server 2003 & 2008.


Solution

  • I don't believe their is a GPO for this. But most group policies simply modify the registry.

    You could create an adm template that modified the settings, or you could simply write a script to adjust the settings.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\PowerShell
    

    If you are not sure how to manually configure the settings, simply adjust the settings in the event log GUI, and set all your other systems to be the same. You may need to restart the system for the changes to go into effect.