How to restrict users from deleting things from event viewer

We have Win 7 pc's running in the environment and the DC's are server 2008 R2..
How can I via  GPO stop users from deleting things in the event viewer and from deleting the log files for them?
LVL 1
vmichAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

strivoliCommented:
Are the users part of the local Administrators or Users group?
0
vmichAuthor Commented:
They are part of the users group and local administrator group
0
strivoliCommented:
Demote them and make them part of the local Users group only. Start with a few of them and if there aren't any issues apply same solution to all of them.
Users shouldn't be part of the local Administrators group. For this and MANY other reasons.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

vmichAuthor Commented:
Sorry there not part of the local administrators group and I need to make this change for all the users via a GPO so we don't have to visit each pc...
0
strivoliCommented:
You can force which users and groups are part of the local Administrators group. You can do that using GPO. This approach demotes the user and prevents him from deleting the log.

Another approach is described on this article. You could set a script (via GPO) that prevents the Administratos group from clearing the log and permitting only THE Administrator.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
vmichAuthor Commented:
Ok I found the GPO...
Thanks
0
strivoliCommented:
You are welcome. Please help us keep EE clean.
If I did help, accept an answer in order to close the question.
If I didn't help, delete the question.
Thank you.

P.S.: optionally, you might explain which else solution you found suitable and accept that solution. This helps others with similar issues.
0
vmichAuthor Commented:
GPO
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.