4621: Administrator recovered system from CrashOnAuditFail
On this page
In testing I configured the log to crash on audit failure and then filled up the security log which indeed brought the system down. I rebooted, reset the CrashOnAuditFail registry setting, cleared the log and restarted. The event was never logged. I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.
Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.
Value of CrashOnAuditFail: %1
This event is logged after a system reboots following CrashOnAuditFail.
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection
Go To Event ID:
Security Log Quick Reference Chart Download now!