| Previous | Next |
| STATUS_USER_MAPPED_FILE | STATUS_TIMER_RESOLUTION_NOT_SET |
STATUS_AUDIT_FAILED
The operation could not emit its required audit event
Security-sensitive APIs can require successful audit generation as part of their contract. Failure can involve an invalid audit parameter set, unavailable auditing service, resource pressure, or inability to write the Security log. The protected operation must not simply pretend the audit occurred.
Capture the Authz or native audit call, event source, parameter array, privileges, and Security-log state. Increasing log size helps only when capacity is the cause; malformed event data and disabled services require different fixes.
What to inspect
- Record the audit API result and every supplied event parameter.
- Check Security log capacity, Event Log service health, and required audit privilege.
- Verify the protected action was rolled back or denied when auditing was mandatory.
References
- Microsoft: AuthzReportSecurityEvent
- Microsoft: Advanced Audit Policy Configuration
- Microsoft: Audit policy recommendations
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.