| Previous | Next |
| SETUP_FAILURE | MBR_CHECKSUM_MISMATCH |
AUDIT_FAILURE
Security audit path failure for AUDIT_FAILURE
AUDIT_FAILURE is bug check code 0x00000086. This bug check indicates that the audit subsystem reached a failure serious enough to stop the system. It is different from a policy that merely denies access; the audit infrastructure itself is involved.
How to read it in a dump for AUDIT_FAILURE
- Inspect the status code and the security/audit stack frames.
- Security products, file-system filters, object callbacks, and policy corruption can be relevant.
- The audit category or object type is more useful than the code name alone.
What to check for AUDIT_FAILURE
- Review recent audit policy changes and security software updates.
- Check for corruption in security descriptors or registry policy data.
- Use symbols to identify whether the failure is in audit generation, log writing, or object access checks.
References for AUDIT_FAILURE
Dump evidence for AUDIT_FAILURE
For AUDIT_FAILURE, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. For AUDIT_FAILURE, allStat summarizes the condition as “Audit attempt has failed.”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for AUDIT_FAILURE
- Run WinDbg
!analyze -v, then inspect the documented meaning of each AUDIT_FAILURE parameter instead of relying only on the probably-caused-by line. - For AUDIT_FAILURE, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with audit.
- For AUDIT_FAILURE, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by AUDIT_FAILURE before collecting the dump and event logs. For AUDIT_FAILURE, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Dump evidence for AUDIT_FAILURE
For AUDIT_FAILURE, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. For AUDIT_FAILURE, allStat summarizes the condition as “Audit attempt has failed.”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for AUDIT_FAILURE
- Run WinDbg
!analyze -v, then inspect the documented meaning of each AUDIT_FAILURE parameter instead of relying only on the probably-caused-by line. - For AUDIT_FAILURE, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with audit.
- For AUDIT_FAILURE, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by AUDIT_FAILURE before collecting the dump and event logs. For AUDIT_FAILURE, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.