[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference decwet::windows-nt

Title:Windows NT
Notice:See note 15.0 for HCL location
Moderator:TARKIN::LIN.com::FOLEY
Created:Thu Oct 31 1991
Last Modified:Fri Jun 06 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:6086
Total number of notes:31449

6074.0. "What happens if the audit log becomes full?" by WOTVAX::gjcpc.reo.dec.com::criddle () Wed Jun 04 1997 07:55

Hi...

Note 760 refers to what happens if the security log becomes full and the 
system halts as a result.

It refers to a 'halt system when security log is full' option.

This does not seem to be present in NT 4 - is that the case?

In NT 4, it seems that to produce this effect, one needs to set the registry 
flag 'CrashOnAuditFail' in the 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA Key to a value of 1.

I assume therefore that the default mode of working is to carry on working 
even if the audit log is full - is this so?

Note 760 states that under the halt conditions, an Administrator was unable to 
log on, the event help information in NT 4.0 suggests that one can - can 
anyone confirm / deny this?

Any comments appreciated?

Rgds,
Graham
T.RTitleUserPersonal
Name
DateLines
6074.1BUSY::SLABAudiophiles do it 'til it hertz!Wed Jun 04 1997 09:086
    
    	You know, NOTES has a REPLY command, which is used to group similar
    	replies into one note.
    
    	[But I don't know why I even bother saying this.]
    
6074.2WOTVAX::gjcpc.reo.dec.com::criddleThu Jun 05 1997 08:469
Thank you.

Since this was a (much) later version of NT I thought it was worth another 
note.

Do you have any insight into the question I raised?

Rgds,
Graham