Bill,
One method of notfication (though an ungraceful method) is to set the
CrashOnAuditFail registry key to a value of 1. When this is set the
machine will force a blue screen then resstart. Upon reboot only and
administrator will be able to logon. At this point they should backup and
clear the Security event log and then set the CrashOnAuditFail reg value
from 2 to 1.
More details are outlined in KB article 140058:
http://support.microsoft.com/?id=140058. Hope that helps.
blim
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| >Content-Class: urn:content-classes:message
| >From: "BillC" <
[email protected]>
| >Sender: "BillC" <
[email protected]>
| >Subject: Event log settings
| >Date: Thu, 18 Dec 2003 11:32:58 -0800
| >Lines: 9
| >Message-ID: <
[email protected]>
| >MIME-Version: 1.0
| >Content-Type: text/plain;
| > charset="iso-8859-1"
| >Content-Transfer-Encoding: 7bit
| >X-Newsreader: Microsoft CDO for Windows 2000
| >X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| >Thread-Index: AcPFnb3j4DdSH27GTh+zKfmtUao45A==
| >Newsgroups: microsoft.public.win2000.security
| >Path: cpmsftngxa07.phx.gbl
| >Xref: cpmsftngxa07.phx.gbl microsoft.public.win2000.security:18052
| >NNTP-Posting-Host: tk2msftngxa12.phx.gbl 10.40.1.164
| >X-Tomcat-NG: microsoft.public.win2000.security
| >
| >I have set my security log settings to overwrite events
| >older than 31 days. The max log size is set to 4096K.
| >When the log fills up events are no longer written but I
| >don't get a notification message that the log is full. I
| >think I should be recieving a message when this occurs.
| >Am I wrong? How can I change this?
| >.
| >
| >
| >
