Windows Server / Services, IIS & Secure Operations
Check server event-log retention before evidence disappears
A busy server can overwrite the incident window before support collects it. Inspect log capacity and retention configuration.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-WinEvent -ListLog System,Application | Select-Object LogName, RecordCount, FileSize, MaximumSizeInBytes, LogMode, IsEnabledRead the result
The metadata reports current log settings and size. It does not guarantee that the required time range remains available.
Resolve and verify
Preserve the relevant bounded events through the approved evidence process. Plan justified capacity or forwarding changes and verify collection continues.
Before changing production
Do not clear logs to fix a full-log symptom or change audit retention without the security owner's requirements.