Anyway to find out what program is asking for admin credentials? I've got a user's iMac that seems to be asking for admin credentials more often than it should be, all it says is that Mac OS requires admin credentials. Is there a way of finding out what application is asking for it?
I would configure syslog to record those details into a file.

Assuming that you are comfortable with editing text files from the command prompt, use your favorite editor and edit /etc/syslog.conf adding this line:

auth.info;authpriv.*;remoteauth.crit   /var/log/authinfo.log


Then send a hangup signal to syslogd via

pkill -HUP -i -l syslogd


F.