Change Windows Event Log Size Using Regedit

This guide explains how to configure the maximum file size for Windows event logs using the Windows Registry Editor (Regedit). By adjusting these registry values, administrators can allocate more storage to retain critical log history for auditing or reduce size limits to conserve system disk space.

Prerequisites

• Administrator privileges on the target Windows machine.
• A basic understanding of the Registry Editor (regedit.exe).

Step-by-Step: Configure Classic Event Logs

Classic Windows logs—such as Application, Security, and System—are managed directly under the Services\EventLog key.

1. Open the Registry Editor

1. Press Win + R to open the Run dialog.
2. Type regedit and press Enter.
3. Click Yes if prompted by User Account Control (UAC).

2. Navigate to the EventLog Key

In the address bar, paste or navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog

3. Select the Target Log

Expand the EventLog key and select the subkey for the log you want to modify: * Application * Security * System * Setup

4. Modify the MaxSize Value

1. In the right-hand pane, locate and double-click the MaxSize REG_DWORD value. (If it does not exist, right-click an empty area, select New > DWORD (32-bit) Value, and name it MaxSize).
2. Under Base, select Decimal.
3. Enter the desired maximum file size in bytes.
   • Note: The value must be a multiple of 64 KB (65,536 bytes).
   • Examples:
     • 20971520 = 20 MB (Default for standard logs)
     • 52428800 = 50 MB
     • 104857600 = 100 MB
     • 1073741824 = 1 GB
4. Click OK.

Step-by-Step: Configure Modern/Application-Specific Event Logs

For specific modern event channels (e.g., PowerShell, TaskScheduler, or Microsoft-Windows logs):

1. In the Registry Editor, navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels

2. Locate the specific channel name (e.g., Microsoft-Windows-PowerShell/Operational).

3. Expand the channel key and select the ChannelProperties subkey.

4. Double-click the MaxSize REG_DWORD value.

5. Select Decimal, enter the desired size in bytes, and click OK.

Applying the Changes

Registry changes to standard Windows event logs typically take effect immediately, but restarting the Windows Event Log service (eventlog) or rebooting the machine ensures that the new size restrictions are fully applied.