A. To avoid security logs being lost you can configure
the system to halt if the security log becomes full so that only
Administrators can logon, they can then archive the log and purge
- Start the registry editor (regedit.exe)
- Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- If CrashOnAuditFail exists then skip to step 4, if not from the Edit
menu select New - DWORD value and enter a name of CrashOnAuditFail.
Click OK
- Double click on CrashOnAuditFail and set to either:
1 - Stop if the audit log is full
2 - This is set by the operating system just before the system crashes
due to a full audit log. When set to 2 only the administrator can logon.
- Close the registry editor
When this happens the OS will display a BSOD.