All,
I'm encountering a very troubling issue at one of my clients, who relies heavily on being compliant.
They have a Windows 2008 server that is set up for object access auditing. On 9/30/09, it appears events could not be written to the event log. Please see:
The event logging service encountered an error while processing an incoming event from publisher Microsoft-Windows-Security-Auditing and trying to process the metadata for it.
EVENT ID: 1107
Then, a few days later, this happened:
Unable to log events to security log:
Status code: 0xc0000017
Value of CrashOnAuditFail: 0
Number of failed audits: 1
EVENT ID: 521
The security log is set to auto-archive after it reaches 20MB.
Being new to Windows 2008 server, and keeping in mind that these guys rely on this to work, I've researched extensively and can't find anything on this.
Can anyone lend me in the right direction?
-
Re: Security Log Issues
Glad to know I'm not the only one, also getting the EventID 521 Unable to log entries to the Security Log after setting up the Auto-Backup.
Have modified the registry HKLM\SYSTEM\CurrentControlSet\Control\LSA\Bound to 00 30 00 00 00 20 00 00
But no joy, still getting the event id 521.
Leave a comment: