Tools · Windows security and Event Logs · 14 / 27
How to set Windows event log size and export logs with wevtutil
Check how many hours your Security log actually holds, raise its maximum size, and export logs to .evtx files for investigation.
Small logs erase evidence
The Security log often defaults to 20 MB on clients and 128 MB on servers. On a busy server with good auditing, that can be hours of history. When an incident is noticed days later, the events are gone without anyone clearing them.
wevtutil gl Security shows the current maximum size and retention mode. Compare the oldest event’s time to now to see your real retention.
wevtutil gl Security (Get-WinEvent -LogName Security -Oldest -MaxEvents 1).TimeCreated Get-WinEvent -ListLog Security,System,'Microsoft-Windows-PowerShell/Operational' | Select LogName, MaximumSizeInBytes, RecordCount
Raise the size
wevtutil sl Security /ms:1073741824 sets a 1 GB maximum. Do the same for System, PowerShell Operational, and Sysmon if installed. In a domain, set sizes with Group Policy under Administrative Templates, Windows Components, Event Log Service, so they cannot drift.
Even with large local logs, central forwarding is the real retention. Local size is your buffer for when forwarding fails.
Lab: export for a case
Export the Security log to a file with wevtutil epl, optionally with a query to limit it to a time window. Hash the exported file so you can show it was not changed later. Then open it on another machine with Event Viewer or Get-WinEvent -Path.
When collecting from many hosts, export the same set of logs from each and keep the hashes in a manifest.
wevtutil sl Security /ms:1073741824 wevtutil epl Security C:\cases\HOST1-Security.evtx wevtutil epl Security C:\cases\HOST1-Sec-window.evtx /q:"*[System[TimeCreated[@SystemTime>='2026-11-02T00:00:00Z']]]" Get-FileHash C:\cases\*.evtx -Algorithm SHA256 | Export-Csv C:\cases\manifest.csv -NoTypeInformation
Archive mode
The “Archive the log when full” option writes full logs to archive files instead of overwriting. It preserves history but can fill the disk, so it suits servers with monitored storage.
Whatever mode you choose, monitor for logs that roll over faster than your incident detection time.
Diagram
From too-small log to preserved evidence
- Measure
Compare the oldest event time with now.
- Resize
Set larger maximums by GPO.
wevtutil sl Security /ms:1073741824
- Forward
Ship logs centrally for long retention.
- Export
For a case, epl to .evtx and hash the files.
Check yourself
1. How do you find how much history your Security log really holds?
2. Which command exports a log to an .evtx file?
3. Why hash exported evtx files?