By default, the PolicyPak Event log located under the "Applications and Services Logs" section in the Event Log (eventvwr.msc) has a size of 1028 KB. If you wish to change the size of the PolicyPak Event log so that more data is retained you can use one of the following methods below.
In the "Maximum log size (KB):" field specify the new maximum size in KB. For example, for 10.0 MB you would specify 10240.
Note: The value specified for KB should be divisible by 64 otherwise you will receive the warning message below.
Expand Computer Configuration > Preferences > Windows Settings > Registry, then select "New" > "Registry Item".
For "Action:" choose "Update", next ensure that "Hive:" is set to HKEY_LOCAL_MACHINE, then set the following values as specified below:
Key Path: SYSTEM\CurrentControlSet\Services\EventLog\PolicyPak
Value name: MaxSize
Value type: REG_DWORD
Value data: 10485760
Note: This example illustrates how to set the PP Event log to 10 MB but you can adjust this size as need. Recommend setting the PP Event log size manually first on a test machine then getting the value needed from the registry of the test machine. The size in the Event log GUI is specified in KB and set in increments of 64 KB, however, the MaxSize value in the Registry needs to be in Bytes.
Click "Next" on the first screen then "Next" again at the "Specify policy target" screen keeping the default of "Apply this policy to the Computer (default) option.
At the "On Appy action" screen choose "PowerShell script" from the drop down then copy in the following command line to the text window before Clicking "Next".
New-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\PolicyPak' -Name 'MaxSize' -Value 10485760 -PropertyType DWord -Force -ea SilentlyContinue
Note: The entire command goes on a single line.
At the "Specify process mode" choose either the "Once" or "Once or when forced" radio button then click "Next".
Lastly, rename the policy with a descriptive name if desired and then click "Finish".