Save eventvwr for several months, just in case

From: Marlon Brown (marlon_brownj_at_hotmail.com)
Date: 06/28/03


Date: Sat, 28 Jun 2003 00:32:58 -0700


My boss requested a domain admin account for some contractors that are
working in a long term project. I am not confident in their skills and I
would like to have eventvwr saved for several months, just in case I need to
investigate who did what in AD & Win2K system.

I have audit enabled following best practices from www.microsoft.com.

My question is regarding saving eventvwr logs. Basically I am using a WMI
script that is able to backup eventvwr on daily basis. The problem is, at
this point I am not sure from which server should I back the event logs ? I
have total of 6 DC's.

What I am concerned at most are abuse of privilege such as consultants using
that account to grant rights to somebody or deleting objects in AD.
If I save the event logs from PDC Emulator, would that be a solid record ?