STOP 0xC0000244 When Security Log Full

• Microsoft Windows NT Server version 4.0
• Microsoft Windows NT Workstation version 4.0
• Microsoft Windows NT Server version 4.0, Terminal Server Edition

SYMPTOMS

If the CrashOnAuditFail registry key is set to 1 and the Security Event log is full on a computer running Windows NT, the following blue screen error message may be displayed:

STOP: C0000244 {Audit Failed}
An attempt to generate a security audit failed.

CAUSE

This problem occurs if the Security Log has reached the Maximum Log Size specified, and Event Log Wrapping is set for "Overwrite Events Older than (X) Days." This can also occur if "Do Not Overwrite Events" is selected. Because the Security Event Log is full, and the CrashOnAuditFail registry key is set, Windows NT generates a STOP 0xC0000244 blue screen error message and cannot log audit information.

RESOLUTION

To work around this problem, use one of the following options:

• Set the Event Log Wrapping for "Overwrite Events as Needed."
• Decrease the amount of information being audited.
• Increase the log file size and use a combination of the previous options listed above.
• Disable auditing.

STATUS

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article.

REFERENCES

For more information on the CrashOnAuditFail key, please see the following Microsoft Knowledge Base article:

Q140058 How To Prevent Auditable Activities When Security Log Is Full

Q178208 CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen

Additional query words:

Keywords          : ntstop ntsecurity 
Version           : winnt:4.0
Platform          : winnt 
Issue type        : kbprb 

Last Reviewed: July 6, 1999