We recently turned on auditing in a GPO, and when non-admin level users login, an error about the "Security Log is Full" is presented. To work around it for now, I had to add the AD user to as a local admin, so that the security log could get over-written. What is the best practice for keeping the auditing turned on, and not having to give local admin rights to each user? These are WinXP clients, with a Win2k8 server.
Use a GPO to adjust your Event Logs settings as appropriate to your environment. You can change maximum size, define retention method and alter the "wrapping" type so the system will automatically overwrite events as needed, for example.
They're found under