The Log event when quota limit exceeded machine setting should be configured correctly. Determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume, and prevents users from changing the logging setting. If you enable this setting, the system records an event when the user reaches their limit. If you disable this setting, no event is recorded. Also, when you enable or disable this setting, the system disables the "Log event when a user exceeds their quota limit" option on the Quota tab, so administrators cannot change the setting while a setting is in effect. If the setting is not configured, no events are recorded, but administrators can use the Quota tab option to change the setting. Fix: (1) GPO: Computer Configuration\Administrative Templates\System\Disk Quotas\Log event when quota limit exceeded (2) KEY: HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota\LogEventOverLimit