1

We recently turned on auditing in a GPO, and when non-admin level users login, an error about the "Security Log is Full" is presented. To work around it for now, I had to add the AD user to as a local admin, so that the security log could get over-written. What is the best practice for keeping the auditing turned on, and not having to give local admin rights to each user? These are WinXP clients, with a Win2k8 server.

Improve this question
1
  • I think I see how to do this - the policy for security log retention was not defined in: Computer Configuration | Windows Settings | Security Settings | Event Log | Retention Method for Security Log
    – bgarlock
    Sep 4, 2012 at 12:56

1 Answer 1

Reset to default
2

Use a GPO to adjust your Event Logs settings as appropriate to your environment. You can change maximum size, define retention method and alter the "wrapping" type so the system will automatically overwrite events as needed, for example.

They're found under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Event Log.

GPO Event Log

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .