99
The red prompt is a good idea, which I also use.
Another trick is to put a large ASCII-art warning in the /etc/motd file.
Having something like this greet you when you log in should get your attention:
_______ _ _ _____ _____ _____ _____
|__ __| | | |_ _|/ ____| |_ _...
Can I disable logs and remove event id 1102 (=log cleared event)?
I already tried:
Auditpol /set /category:* /success:disable
But that didn't work for event 1102!
