How can you prevent rogue Administrators then from modifying event logs on your system? By consolidating the logs on your systems to a safe and secure central location. One great way for doing this is to use Audit Collection Services (ACS), a part of Microsoft System Center Operations Manager 2007, see http://technet.microsoft.com/en-us/library/bb381258.aspx for details. Archiving your centralized logs offline at a secure site will add even more security to this scenario.
Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is THE book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. For more information see www.mtit.com.