Security Log Guard

A PowerShell script that catches the Windows Security log lockout before it locks users out, and fixes it when it has already tripped.

Send me the scriptView on GitHub

What it does

  • Reads the Security log mode, size, and percent full
  • Flags the root cause: a log set to Do Not Overwrite (LogMode Retain) that will halt logons when it fills
  • Detects the lockout after it has tripped by reading CrashOnAuditFail
  • Archives and clears the log, resets CrashOnAuditFail from 2 back to 1, and sets the log to overwrite at a sane size so it cannot recur
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\SecurityLogGuard.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$WarnThresholdPercent = 90       # remediate once the log is this full
$TargetMaxSizeBytes   = 256MB    # size to set the Security log to
$WhatIf               = $true    # $false to actually apply the fix

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when the log is on Do Not Overwrite, over the threshold, full, or the lockout has tripped) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Full walkthrough with screenshots: Windows 11 Security Log Full? Fix the ‘Only Admins Can Log On’ Lockout

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.0.1Latest

    • Never clears the Security log unless the archive succeeded. In 1.0.0 a failed archive (full disk, no rights) was still followed by a clear, which lost the events. Now it stops, logs why and exits 1 so Intune shows the remediation failed.
    • Checks the clear and the switch to overwrite as needed too, and exits 1 if either fails.
    • PowerShell Gallery metadata (PSScriptInfo), ready for Install-Script Atliso-SecurityLogGuard.
    Download v1.0.1 from GitHub

  2. v1.0.0

    Initial public release. MIT licensed. Download the zip below or clone the repo. See README for usage and the linked Atliso guide.

    Download v1.0.0 from GitHub

Get Security Log Guard

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.