I've got a user's iMac that seems to be asking for admin credentials more often than it should be, all it says is that Mac OS requires admin credentials. Is there a way of finding out what application is asking for it?
I would configure syslog to record those details into a file.
Assuming that you are comfortable with editing text files from the command prompt, use your favorite editor and edit /etc/syslog.conf adding this line:
Then send a hangup signal to syslogd via
pkill -HUP -i -l syslogd