|
Posted by Special Access on October 24, 2006, 6:40 pm
If you were Registered and logged in, you could reply and use other advanced thread options
On Tue, 24 Oct 2006 07:14:02 -0700, Job
>Dear All,
>
>I activated most of security audit (within the default domain controller
>policy) for the domain controllers installed with Windows 2000 sp4 (Active
>Directory) and it ran well.
>Then I have recently upgrated to Windows 2003 sp1 all domain controllers and
>now I get the following error when I open a session on domain controllers :
>
>"the security log on this system is full"
>
>When I look at the properties of security event logs file, it shows that
>the log size isn't full and there is enough space to further events security
>logs. Could you tell me why I get this error ?
>I precised that I have defined the log to overwrite events security logs
>older than 60 days.
>Thanks for your help,
>Job
Open REGEDIT and look at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA and look for a
key of "CrashOnAuditFail". It's value should be either 0 (ignore) or
1 (active). If it's value is 2 (tripped) or NONE (also tripped) then
you need to reset it to either 1 or 0 and reboot.
The fact the log isn't full won't stop this error. This is because
the system can't write to the security log "for whatever reason". This
reason could be:
Disk is full
Log is full
Your stomach is full
The candy dish on the table is full
<smile>
If "crash on audit fail" is active, and the system can't write to the
log, it will crash and give you this error.
Mike
| 
XML site map