CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen

(Last modified: 09Jun2003)

This document (10084015) is provided subject to the disclaimer at the end of this document.

symptom

fact

Microsoft Windows NT Server 4.0 Terminal Server Edition

Microsoft Windows 2000 Server

Microsoft Windows NT Workstation 4.0

Microsoft Windows NT Server 4.0

symptom

Non-administrators will not be able to log on as a result of the CrashOnAuditFail key being set to 0x1.

When you shut down your computer, the computer may stop responding (hang), and you may receive the following error message on a blue screen:

STOP 0xC0000244
An attempt to generate a security audit failed
This behavior may occur even if the audit log is not full.

cause

Windows NT attempts to report a logoff audit in the event log after the event log has shut down. As this audit attempt fails and CrashOnAuditFail is enabled, the system displays a blue screen error message that reports an audit failure.

fix

You can work around this problem by disabling logon/logoff auditing.
In some instances, the server may not bugcheck, but may instead run very slowly after administrator logon. The system may also report continuous RPC errors after logon. Non-administrators will not be able to log on as a result of the CrashOnAuditFail key being set to 0x1.

document

Document Title:	CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen
Document ID:	10084015
Solution ID:	NOVL90134
Creation Date:	09Jun2003
Modified Date:	09Jun2003
Novell Product Class:	NetWare

disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.