The Log event when quota warning level exceeded machine setting should be configured correctly. Determines whether the system records an event in the Application log when users reach their disk quota warning level on a volume. If you enable this setting, the system records an event. If you disable this setting, no event is recorded. When you enable or disable the setting, the system disables the corresponding "Log event when a user exceeds their warning level" option on the Quota tab, so that administrators cannot change logging while a setting is in effect. If the setting is not configured, no event is recorded, but administrators can use the Quota tab option to change the logging setting. This setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their warning level because their status in the Quota Entries window changes. Fix: (1) GPO: Computer Configuration\Administrative Templates\System\Disk Quotas\Log event when quota warning level exceeded (2) KEY: HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota\LogEventOverThreshold