Long story short I changed the Default Domain GPO (stupid I know) so that only Administrators had the Manage auditing and security log right under Computer Configuration > Security Settings > Local ...
Collecting too much log data overwhelms systems and staff. Centralized event log management lets you filter for the most significant security data. More companies are using their security logs to ...