Windows 10: About 300 security audit messages per minute

I am running Windows 11 home on my desktop PC and I am experiencing a huge number of security audit messages - typically 300 per second. My laptop on which I am writing this typically only experiences about 50 per minute. On the desktop, over a 3 minute period there were about 900 messages. These were message 4624 about 65, 4648 5, 4672 136, 4688 10, 4738 2, 4798 29, 4799 9, 5058 186, 5059 6, 5061 185, 5379 289 and a few other messages. I have been experiencing BSOD issues when the PC is apparently doing little or nothing except these audits. Co-Pilot suggested g

:)

 

Windows 10 Profssional 10 1809 osBuild 17763-134 Window Security Auditing

Hi,

Thank you for writing to Microsoft Community Forums.

1. What is the model number of the device?
   
2. Is your computer connected to Domain Network?
   

Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine
the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment.

You may refer the article Security Auditing
and Basic security audit policy settings for
more information.

If the computer is not on a Domain network, proceed with the below suggested steps

Start your PC in safe mode. Refer the article on how to start your
PC in Safe mode in Windows 10. If the issue is fixed in Safe mode, try to check in
clean boot.

Note: A ‘clean boot’ starts Windows with a minimal set of drivers and startup programs, so that you can determine whether a background program is interfering with your game or program.

Your computer may temporarily lose some functionality while in a clean boot environment, however, that functionality will return when you reset the computer to start normally after you have finished your troubleshooting.

You may refer the article on how
to perform a clean boot in Windows.

Refer the section How to determine what is causing the problem after you do a clean boot, if your device is working fine in clean boot.

Also refer the section Reset the computer to start normally after clean boot troubleshooting.

If the computer is on a Domain network, you can contact your IT administrator or you can post your query in

TechNet Forums.

Hope it helps.

Muralidhar

Microsoft Community Moderator

 

Too Many 'Audit Success' Security-Auditing Events Happening

That's not true. Security Audit messages are enabled by default. They didn't used to be, IIRC back in the XP days, but they have since at least vista. Don't believe me? Check your own security log.

To the original posted (yikes, 2005!) this is normal. You get tons of these in the event log by default.

 

Audit mode

Hi Diane,

Windows boots into Windows Welcome Mode and Audit Mode. Windows Welcome Mode
is the first user experience while the Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit
Mode when upgrading or reinstalling Windows 10, the upgrade won’t progress.

Here's how to exit from Audit mode to reinstall Windows 10:

• Open the administrative or elevated Command Prompt. Type cmd in the
  Search field at the taskbar.
• Type the following command and press Enter key: sysprep /oobe /generalize
  DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing this command.
  
  
• Once the command IS successfully executed, you’ll be out of Audit Mode. Now you can re-try to upgrade to Windows 10 and it should work.

Let us know if the steps above worked for you.