Direct answer
Review log size and overwrite behavior alongside the rate of events, forwarding health and the retention period your team needs. Verify collection using an authorized sample event and account for offline devices.
Understand retention needs
Ask incident responders how far back they need to investigate and where the authoritative copy of endpoint logs is stored. Different device groups may have different requirements. Estimate the event volume as well as the configured maximum log size; a larger size alone does not establish a specific number of days.
Review device log settings
Inspect the Security log's maximum size and retention or overwrite behavior through the supported Windows tools or management policy. Document what occurs when the log reaches capacity, and involve the device owner before changing settings. Microsoft describes event log policies governing size and retention.
Reference: Microsoft: Event log policies.
Verify the forwarding path
Use an approved test event and correlate device, event time and collector record. Check collector alerts, last contact and queue health, including devices that are offline or outside the corporate network. A local event may exist even when forwarding is delayed.
Protect and test the records
Restrict read and export access because security logs can contain account and device details. Confirm time synchronization, central retention and restoration of a sample record with the operations team. Track missing or stale devices explicitly and repeat checks after policy or collector changes.
Assessment limits
Retention depends on event volume, local settings, collection delays and central storage. A sample proves only the path and time tested, not complete historical coverage.
Frequently asked questions
Does a large local log guarantee 90 days of history?
No. Actual duration depends on event volume and overwrite behavior. Measure observed coverage.
Does a forwarded event prove all devices are reporting?
No. Check inventory, last contact, errors and offline devices separately.
Why restrict access to security logs?
They can reveal usernames, device details and operational activity that should be handled under the organization's access and retention policies.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.