Atliso-SecurityLogGuard
1.0.1
When the Security event log is set to Do Not Overwrite (LogMode=Retain) and fills
up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator
until the log is cleared. This script catches the condition early and remediates it:
it resizes the log, sets it to overwrite as needed, and - if the lockout has already
tripped - archives and clears the
up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator
until the log is cleared. This script catches the condition early and remediates it:
it resizes the log, sets it to overwrite as needed, and - if the lockout has already
tripped - archives and clears the
When the Security event log is set to Do Not Overwrite (LogMode=Retain) and fills
up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator
until the log is cleared. This script catches the condition early and remediates it:
it resizes the log, sets it to overwrite as needed, and - if the lockout has already
tripped - archives and clears the log and resets CrashOnAuditFail from 2 to 1.
Runs audit-only by default (-WhatIf $true). Set -WhatIf $false to apply changes.
Intune usage: deploy as a Remediation. The detection half exits 1 when the log is
on Do Not Overwrite, at/over the warn threshold, full, or the lockout has tripped.
Run as SYSTEM, 64-bit.
Show more
up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator
until the log is cleared. This script catches the condition early and remediates it:
it resizes the log, sets it to overwrite as needed, and - if the lockout has already
tripped - archives and clears the log and resets CrashOnAuditFail from 2 to 1.
Runs audit-only by default (-WhatIf $true). Set -WhatIf $false to apply changes.
Intune usage: deploy as a Remediation. The detection half exits 1 when the log is
on Do Not Overwrite, at/over the warn threshold, full, or the lockout has tripped.
Run as SYSTEM, 64-bit.
Installation Options
Owners
Copyright
(c) 2026 Atliso. MIT License.
Package Details
Author(s)
- Atliso
Tags
Intune Security EventLog CrashOnAuditFail Lockout Remediation
Functions
Dependencies
This script has no dependencies.
Release Notes
Never clears the Security log unless the archive succeeded. Every wevtutil call is checked.
FileList
- Atliso-SecurityLogGuard.nuspec
- Atliso-SecurityLogGuard.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.0.1 (current version) | 8 | 10/23/2026 |