| Previous | Next |
| ERROR_MCA_EXCEPTION | ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY |
ERROR_ACCESS_AUDIT_BY_POLICY
access to the object is being audited because of a policy rule.
ERROR_ACCESS_AUDIT_BY_POLICY means that this condition This code is informational: an access attempt matched a policy that requests auditing. It does not necessarily say that access was denied. The formatted message normally identifies both the object and the rule that caused monitoring.
Where the result appears
- Windows security auditing and advanced audit policy processing.
- resource access controlled by central access policies.
- file-server or compliance software presenting policy evaluation details.
- security telemetry that records why an otherwise successful open generated an audit.
What the result tells you
The value identifies a specific Windows state, but it does not by itself identify the component that introduced that state. Preserve the original this result value, the API or subsystem that produced it, and the object being operated on. A wrapper that replaces it with a generic exception or Boolean failure removes the distinction needed to choose the correct recovery path.
Diagnostic evidence to collect
- the object path or resource identifier and requested access mask.
- the user, group, device, and claims used during evaluation.
- the central access or audit rule name and policy version.
- the matching Security log event, outcome, and correlation identifier.
Correlate the result evidence on one timeline. The first event that changes the state associated with this result is usually more valuable than later retries returning the same code. Record process and thread identity, session, timestamp, API parameters, and the immediately preceding successful operation.
Handling and recovery
Record the event as policy-driven visibility. If audit volume is unexpectedly high, adjust the rule scope rather than suppressing the status in application code. When access also failed, keep the denial code separately because this value alone does not express authorization failure.
Retry after this result only when the evidence shows that an external condition can change. When it is caused by malformed input, revoked authority, unsupported state, hardware damage, or an offline maintenance requirement, an unchanged retry adds noise and can overwrite the earliest useful diagnostics.
Common misinterpretation
Do not display “access denied” solely from it. A request may succeed and still be audited.
Guidance for developers
Keep it in its Win32/LRESULT domain in structured telemetry. When converting it to an HRESULT, exception, RPC response, or JSON field, retain the source domain and numeric value alongside the human-readable text. Do not branch on the localized message string for this Win32 error.
A test should construct the specific state, assert the exact result, and verify that partial resources are released. The recovery test for this Win32 error should prove that the operation is either deferred until a measurable state change or fails without an uncontrolled retry loop.
References
Looking for a different code? Search another status or error code.