Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently turned on auditing in a GPO, and when non-admin level users login, an error about the "Security Log is Full" is presented. To work around it for now, I had to add the AD user to as a local admin, so that the security log could get over-written. What is the best practice for keeping the auditing turned on, and not having to give local admin rights to each user? These are WinXP clients, with a Win2k8 server.

share|improve this question
I think I see how to do this - the policy for security log retention was not defined in: Computer Configuration | Windows Settings | Security Settings | Event Log | Retention Method for Security Log – bgarlock Sep 4 '12 at 12:56

Use a GPO to adjust your Event Logs settings as appropriate to your environment. You can change maximum size, define retention method and alter the "wrapping" type so the system will automatically overwrite events as needed, for example.

They're found under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Event Log.

GPO Event Log

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.