Security Log Guard

A PowerShell script that catches the Windows Security log lockout before it locks users out, and fixes it when it has already tripped.

Get it by emailView on GitHub

What it does

  • Reads the Security log mode, size, and percent full
  • Flags the root cause: a log set to Do Not Overwrite (LogMode Retain) that will halt logons when it fills
  • Detects the lockout after it has tripped by reading CrashOnAuditFail
  • Archives and clears the log, resets CrashOnAuditFail from 2 back to 1, and sets the log to overwrite at a sane size so it cannot recur
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\SecurityLogGuard.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$WarnThresholdPercent = 90       # remediate once the log is this full
$TargetMaxSizeBytes   = 256MB    # size to set the Security log to
$WhatIf               = $true    # $false to actually apply the fix

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when the log is on Do Not Overwrite, over the threshold, full, or the lockout has tripped) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Full walkthrough with screenshots: Windows 11 Security Log Full? Fix the ‘Only Admins Can Log On’ Lockout

Get Security Log Guard

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.