| Previous | Next |
| STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION | STATUS_ABANDON_HIBERFILE |
STATUS_ACCESS_AUDIT_BY_POLICY
The access is subject to an explicit audit rule
This informational status says that the access decision matched policy that requires an audit trail. It is not the same as STATUS_ACCESS_DENIED: the operation can still be permitted while Windows records who accessed the object, which rights were requested, and which policy or SACL rule caused auditing.
Preserve the object type, desired access mask, token identity, and resulting audit event. If the event volume is unexpected, inspect both the system audit subcategory and the object SACL; changing a DACL will not remove an audit ACE, and disabling auditing can hide evidence without correcting the policy.
What to inspect
- Correlate the status with the Security log event and the object name or handle.
- Inspect the SACL and effective audit policy rather than only the DACL.
- Verify success and failure auditing are configured for the intended access mask.
References
- Microsoft: AuthzReportSecurityEvent
- Microsoft: Advanced Audit Policy Configuration
- Microsoft: Access control model
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.