Audit: Shut down system immediately if unable to log security audits
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Audit: Shut down system immediately if unable to log security audits
Description
This security setting determines whether the system shuts down if it is unable to log security events.
If this security setting is enabled, it causes the system to stop if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the retention method that is specified for the security log is either Do Not Overwrite Events or Overwrite Events by Days.
If the security log is full and an existing entry cannot be overwritten, and this security option is enabled, the following Stop error appears:
STOP: C0000244 {Audit Failed}
An attempt to generate a security audit failed.
To recover, an administrator must log on, archive the log (optional), clear the log, and reset this option as desired. Until this security setting is reset, no users, other than a member of the Administrators group will be able to log on to the system, even if the security log is not full.
Note
- When configuring this security setting, changes will not take effect until you restart Windows.
Default: Disabled.
Configuring this security setting
You can configure this security setting by opening the appropriate policy and expanding the console tree as such: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
For specific instructions about how to configure security policy settings, see Edit security settings on a Group Policy object.
For more information, see: