Specify the maximum log file size (KB)
This computer policy limits the maximum size of the Windows Security log.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\EventLog\Security\MaxSize
This computer policy limits the maximum size of the Windows Security log. MaxSize is a REG_DWORD value whose data represents the size in kilobytes.
Microsoft documents a supported range of 20480 KB (20 MB) through 2147483647 KB (2 TB) for this policy. When the policy isn't in effect, Windows uses the locally configured maximum size. Microsoft identifies 20 MB as the default, although the local configuration can differ.
The setting doesn't select which security events are audited and doesn't determine what happens when the log becomes full. Audit and retention settings control those behaviors separately.
Notes
Security
The Security log's capacity affects how long security events can remain available for monitoring, incident investigation, and forensic analysis. A limit that is too small for the system's event volume causes the log to reach capacity more frequently.
The result depends on the retention mode. When overwriting is allowed, incoming events replace the oldest entries. When existing events must be retained, Windows discards incoming events after the log reaches its maximum size. The size limit by itself therefore neither prevents events from being overwritten nor guarantees that every new event will be recorded.
Possible side effects
A higher limit increases the maximum potential disk-space consumption of the Security log file. A lower limit can reduce the available event history or, when retention without overwriting is enabled, cause the log to reach capacity and begin discarding new events sooner.
Notes
The policy value under HKLM\Software\Policies\Microsoft\Windows\EventLog\Security is expressed in kilobytes. It shouldn't be confused with the MaxSize value under the Event Log service's runtime registry keys, which the Win32 documentation describes in bytes.
Actual retention time depends on event volume as well as the separately configured overwrite, retention, and automatic-backup behavior.
Microsoft documentation
Microsoft Learn: Policy CSP – EventLogService – SpecifyMaximumFileSizeSecurityLog
Microsoft Learn: wevtutil – behavior when a log reaches its maximum size