Windows Security Log Event ID 1104

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Non Audit (Event Log)
 • Event processing
Type Success
Corresponding events
in Windows 2003
and before

1104: The security Log is now full

On this page

No more events will be logged until the log is expanded, cleared or configured to overwrite events.

This event indicates a "hole" in your audit trail and should be avoided with the implementation of an effective log management solution that collects events before they can be overwritten or before the log fills up.

"Do not overwrite events (clear log manually)" should only be used in conjunction with the security option "Audit: Shutdown system immediately if unable to log security audits".  Of course these 2 settings together will cause the system outages if the log is allowed to fill up and would only be appropriate for systems with the highest integrity requirements on audit trails.

Free Security Log Resources by Randy

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.




Additional Resources