To halt the computer when the security log is full
Open Event Viewer
In the console tree, right-click Security, and then click Properties.
On the General tab, click either Overwrite events older than n days or Do not overwrite events (clear log manually).
Use Registry Editor to create or assign the following registry key value:
Restart the computer.
Incorrectly editing the registry may severely damage your system. You should back up any valuable data on the computer before making changes to the registry.
After this procedure is completed, when the security log becomes full, Windows XP will stop responding and will display the message "Audit Failed." To recover when Windows XP stops, the security log must be cleared. For more information, see Related Topics.
To open Event Viewer, click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Event Viewer.
You must be logged on as administrator or as a member of the Administrators group to complete this procedure.
If Windows XP halts as a result of a full security log, you must restart the system and repeat this procedure if you want a full log to stop the computer in the future.
To start Registry Editor, click Start, click Run, type regedit, and then click OK. For more information about Registry Editor, on the Registry Editor Help menu, click Help Topics.
Recover if the operating system stops
Using Event Viewer
Event Viewer overview
Specify files and folders to audit
Set up auditing of files and folders
Turn on security logging
Turn on security logging for a domain controller
Halting the computer when the security log is full
Auditing file and folder access
Managing the audit policy
Monitoring Windows XP security events