WinSecWiki > Security Settings > Local Policies > Audit Policy > Non Audit > Event Processing

Event Processing (Eventlog source)

These events are logged even if you disable all auditing. 

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
1101	Audit events have been dropped by the transport.
1104	The security Log is now full
1108	The event logging service encountered an error
4612	Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

Back to top

 

Upcoming Webinars “3 Persistent Privileged Access Methods in Active Directory: How Attackers Stick the Landing with AdminSdHolder, SIDHistory, DCShado”

Additional Resources