What does Windows error code 8625 (ERROR_DS_AUDIT_FAILURE) mean?

ERROR_DS_AUDIT_FAILURE

A required audit event could not be generated for the operation.

ERROR_DS_AUDIT_FAILURE is Win32 error 8625 (0x000021B1) in Active Directory Domain Services.

Likely impact: Bypassing the check would create an unaudited security-sensitive modification and is not a valid recovery.

Typical causes

• Security log or audit subsystem is unavailable.
• audit policy requires an event that cannot be emitted.
• resource pressure prevents audit generation.
• the service cannot communicate with security logging.

Troubleshooting steps

1. Verify that the security subsystem can record the required audit before the protected operation is accepted.
2. Collect Security log state and capacity and audit policy and subcategory.

Useful evidence

• Collect operation and caller token.
• Collect first audit-generation status.

Recovery and retry

Restore mandatory audit logging and verify a test event before retrying the directory operation.

Related errors

ERROR_DS_AUTHORIZATION_FAILED denies the access check; this code rejects an operation because its required audit record cannot be generated

Example

A protected directory change fails while the Security log service is unavailable. Restoring logging and confirming the audit event allows the same authorized change.

References

• Microsoft: exact Win32 system error range
• Microsoft: AD DS troubleshooting
• Microsoft: dcdiag
• Microsoft: repadmin