Windows 10: audit events have been dropped by the transport. 0

I keep getting the same error in event viewer for the longest time BSODing my pc."audit events have been dropped by the transport. 0" keeps turning up as an error after mant attempts of fixing it does anyone know how to or has been able to fix this issue?

:)

 

Event 1101 Error

Audit events have been dropped by the transport. 0

This makes my PC Restarts..Please Help

 

Disable auditing of successful events

I want to disable auditing of successful events!

This command worked (at least CMD said it did) Code:

I need to check in event log, if there are reported any longer successful events. Problem is: overall there are too many categories to check manually!!!
So i ran this command: Code:

And i got:
System audit policy
Category/Subcategory
"No auditing" for all categories!

which is strange for 2 reasons:
- i have auditing, minimally of failure events
- there should be now auditing only for successful events...
Also in local security policy program, there is under local policy/audit policy no auditing!
While in Event Viewer i have literally under: Windows logs/Security listed events with name Audit success! So auditing had to be on! And this is even stranger, in local security policy program, i have not configured under Advanaced Audiot Policy Configuration/System Audit Policies - Local Group Policy Object. Which should be same category as by that command i used in cmd. And i had there not configured before. Which doesn't exclude auditing, if it is configured elsewhere.

Difference is i have, in what should be same category, no auditing, if i use that command in CMD! But in local security policy program: i have not configured. Which contradicts itself!

Now i am confused, what is what?!

EDIT:

Even that command executed successfully. I have still audit success in Event Viewer. Windows logs/security in particular. Anyone help? How do i disable auditing of successful events for every category?

THANKS!


Solved:

After some more googling, i found, which category is related to security events. And you can't probably disable logging of only successful events for this category.

I created custom view and for any other category, there are no successful events. So command: auditpol /Set /Category:* /success:disable should be working!

 

Security Audit Failure Event 5061 In Windows 10

Hello,

A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.

The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.

Advanced Security Auditing FAQ