Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

STOP 0xC0000244 when security log full


View products that this article applies to.

This article was previously published under Q232564

↑ Back to the top


Symptoms

If the CrashOnAuditFail registry key is set to 1 and the Security Event log is full on a computer that is running Microsoft Windows NT, Microsoft Windows 2000, or Microsoft Windows Server 2003, the following blue screen error message may be displayed:
STOP: C0000244 {Audit Failed}
An attempt to generate a security audit failed.

↑ Back to the top


Cause

This behavior occurs if the Security Log has reached the Maximum Log Size specified, and Event Log Wrapping is set for "Overwrite Events Older than (X) Days." This can also occur if "Do Not Overwrite Events" is selected. Because the Security Event Log is full, and the CrashOnAuditFail registry key is set, Windows generates a STOP 0xC0000244 blue screen error message and cannot log audit information.

↑ Back to the top


Resolution

To work around this behavior, use one of the following options:
  • Set the Event Log Wrapping for "Overwrite Events as Needed."
  • Decrease the amount of information being audited.
  • Increase the log file size and use a combination of the previous options listed above.
  • Disable auditing.

↑ Back to the top


Status

This behavior is by design.

↑ Back to the top


More information

In some instances, the server may not bugcheck, but may instead run very slowly after administrator logon. The system may also report continuous RPC errors after logon. Non-administrators will not be able to log on as a result of the CrashOnAuditFail key being set to 0x1.

↑ Back to the top


References

For additional information about the CrashOnAuditFail key, click the following article numbers to view the articles in the Microsoft Knowledge Base:
140058� How to prevent auditable activities when security log is full
178208� CrashOnAuditFail with logon/logoff auditing causes blue screen

↑ Back to the top


Keywords: kbprb, KB232564

↑ Back to the top

Article Info
Article ID : 232564
Revision : 8
Created on : 2/26/2007
Published on : 2/26/2007
Exists online : False
Views : 140