The “Registry-Force” Method

To ensure the size is actually >1GB and both tools agree, use this direct registry update. This is how you guarantee the log size on a Domain Controller:

powershell (not PWSH)

# Set the log to 1GB (1073741824 bytes)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "MaxSize" -Value 1073741824 -Type DWord

# Ensure the log is set to overwrite
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "Retention" -Value 0 -Type DWord

How to check this is so look at ‘retention’. It should be ‘false’.

wevtutil gl Security

Then you should be sure of your maxSize setting:

wevtutil gl Security | Select-String "maxSize"

Since you are managing IT infrastructure for a domain, having this locked in the registry is much more reliable than relying on ‘wevtutil‘ commands which sometimes report stale data from the WMI provider.