MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning Countermeasure: Configure the MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning entry to a value of 90. The possible values for this registry entry are: ? 0 to 100. The default configuration is 0 (no warning event is generated). In the SCE UI, the following options are available: ? 50% ? 60% ? 70% ? 80% ? 90% ? Not Defined Potential Impact: This setting will generate an audit event when the Security log reaches the 90 percent-full threshold unless the log is configured to overwrite events as needed. Fix: (1) GPO: Computer ConfigurationAdministrative TemplatesMSS (Legacy)MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning (2) REG: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlogSecurity!WarningLevel

[0% percentage/50% percentage/60% percentage/70% percentage/80% percentage/90% percentage]

(1) GPO: Computer Configuration\Administrative Templates\MSS (Legacy)\MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning (2) REG: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security!WarningLevel