Configuring event log settings

Event log size needs to be defined to prevent loss of audit data due to overwriting of events. 

•  Open the GPMC and, based on your setup, right-click Default Domain Controllers Policy or ADAuditPlusMSPolicy or ADAuditPlusWSPolicy, then select Edit. 

• Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
• Set Retention method for security log to Overwrite events as needed.
• Configure the Maximum security log size as defined below. Ensure that the security log can hold a minimum of 12 hours’ worth of data.