Why is services.exe changing the Event Log retention policy?

Question

I have a server running Windows 2003 R2 Enterprise Ediditon with Service Pack 2. I reset the Application Event Log Retention policy within EventVwr (right-click on Application, click the radio button next to "Overwrite events as needed".) A few hours later, somehow this setting got reset to "Overwrite events older than 7 days." This happened several times, so I started up RegMon to monitor what was changing this setting. The setting is located at HKLM\System\CurrentControlSet\Services\EventLog\Applicatin\Retention. I found out that services.exe is changing this setting on a regular basis. Can anyone tell me why services.exe would be automatically changing the Event Log retention policy, and how I can make it stop doing that?

Answer 1

The usual cause for this would be that the machine is part of a domain and Group Policy is being pushed down and applied by something running within services.exe.

That said - you'd probably be better asking this question at serverfault.com =)