 For this reason, once the Administrator account has been compromised, the event history as contained in the Security Log is unreliable.A defense against this is to set up a remote log server with all services shut off, allowing only console access.As the log approaches its maximum size, it can either overwrite old events or stop logging new events.