How to Fix Event ID 521, Unable to log events to Security log

You can fix the problem if you encounter Event ID 521 along with the statement "Unable to log events to security log" on Windows Server. The issue will be there if the maximum log size is set to a value lower than maximum or to the minimum.

You can fix this issue by adjusting the maximum log size limit. There is a couple of ways to do it. You have two main options: the Group Policy Management Console and the Event Viewer.

Event 521 of The security log cannot be updated

Try one of the following solutions if you get a Windows Server error "Unable to log events to security log" with an Event ID of 521:

Define Maximum Log Size is allowed in Event Viewer.

Set Maximum Log Size using GPMC.

Methods for Modifying Windows Event Viewer's Maximum Security Log Size

1. Using Event Viewer to Set a Maximum Log Size.

First, open Event Viewer by using the Taskbar search box and searching for event viewer then click one of the results, or by using the keyboard shortcut Win+R, typing in eventvwr, and pressing Enter.

Once opened, click the Security menu, then in the context menu select Properties, then click Windows Logs.

The option Maximum log size is present here. In case its size is less than the size, then restore it to 10240. Whereas, if it has been set to 10240, then the size is altered to 20480.

Now select the option "overwrite events as needed".

Finally, click the OK button in order to commit the edit.

2.Get maximum log size using GPMC

You are going to need to open the Group Policy Management Console to change the maximum log size. Press Win+R, then type in gpmc.msc and click Enter.

Click the Domains option to highlight the domain your computer is currently connected to. Once highlighted right-click on the Default Domain Controllers Policy under the Group Policy Objects. From the context menu select Edit.

Next follow this path:

In the Windows Control Panel, under Policies, click on the Event Log.

That is where the Maximum security log size option is located. The maximum log size should be 10240. If it exists, change it from 10240 to 20480.

In the list of retention methods for the security log, select "Overwrite events as needed".

Hit OK to save the changes finally.

Hopefully, this will solve your problem. You have to reinstall Active Directory Domain Services, but in the case of if that doesn't work either. You will need Windows PowerShell and the Server Manager. If you are doing it for the first time, then here is a short overview of what you must do to uninstall and then install again on Windows Server.

To uninstall Active Directory Domain Services, open PowerShell with elevated rights and run the following cmd:

remove-addsdomaincontroller /?

But to uninstall AD DS from another DC you can run the following cmd:

ManageDomainController removal

But on Server Manager, under Remove server roles tab, you can achieve the same by de-selecting the Active Directory Domain Services check box:.

A pop-up will appear asking you to confirm delete extra jobs. OK it.

The following is required to reinstall this in order to access Windows PowerShell. On the other hand, you will still have to provide whether you want to install AD DS for a local or remote server. Firstly, Remote Server Administration Tools will be installed to take control of a remote server. Correspondingly, this can be done with the help of this command:

Installation of Windows Feature -name AD Domain Services -Include Management Tools

It will be necessary to run the AD DS Deployment Module. This could be done via the following command:

Deployment Module: Get-Command

Just for your information, you can execute help to find out all the parameters.

Surely, these steps will lead you to solve the problem in the most successful way.