Change Security Event Log Size Using Regedit

This guide explains how to adjust the maximum file size limit for the Windows Security event log using the Windows Registry Editor (Regedit). Modifying this setting allows administrators to expand log capacity to retain critical security audit data longer, preventing important events from being prematurely overwritten or dropped on high-traffic systems.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

Step 2: Navigate to the Security Event Log Key

In the Registry Editor, navigate to the following registry path using the left sidebar:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security

Step 3: Modify the MaxSize Value

  1. With the Security key selected in the left pane, locate the MaxSize entry in the right pane.
  2. Double-click MaxSize to open its edit window.
  3. Under the Base section, select the Decimal radio button to enter the size in standard byte format.
  4. In the Value data field, enter the desired maximum log size in bytes.
    • Note: The value must be a multiple of 64 KB (65,536 bytes).
    • Example values:
      • 50 MB: 52428800
      • 100 MB: 104857600
      • 200 MB: 209715200
      • 500 MB: 524288000
  5. Click OK to save the changes.

(If the MaxSize value does not exist, right-click an empty area in the right pane, select New > DWORD (32-bit) Value, name it MaxSize, and then perform the steps above.)

Step 4: Apply the Changes

The new maximum size limit takes effect immediately for the Security log file. To verify the change, open the Event Viewer (eventvwr.msc), expand Windows Logs, right-click Security, select Properties, and confirm that the Maximum log size (KB) reflects your updated registry configuration.