How to troubleshoot 521 Events in Windows Security Log

Question

I am getting a slew of Event 521 in the WIndows Security Log on about half my DCs.  they are triggering Critical Alerts in ADAudit, so I need to determine the cause and resolve it.  So far, I have

• Rebooted the DC
• Confirmed adequate disk space
• Confirmed permissions on the .evtx file
• Cleared the Security Log
• Deleted and re-create the Security .evtx file
• Set Log size to 1GB
• Enabled AutoArchive of the Logs
• Set Security Log BufferSize=256 and MaxBuffers=64

 Any suggestions on how to troubleshoot this and find the cause would be roundly appreciated

Answer 1

Hello Kel Koop,

thank you for posting on the Microsoft Community Forums.

Based on the description, I understand that your issue is related to Windows Security, which is out of my scope. To resolve this issue, you can refer to this two link: How to find the root cause for the event ID 521 for the 2019 windows servers ? - Microsoft Q&A and How to find the root cause for the event ID 521 for the 2019 windows servers ? - Microsoft Q&A.

Hope it helps.

Best regards,

Lei

Answer 2

Hello Lei,

I appreciate your time to answer my question. However, the 'two' links you provided are the same one. Also, in my OP, I bulleted the steps I've taken because I have read the entire thread you sent - plus several more - and applied the suggested solutions.

None have improved the problem.

What I could use at this point is some direction on how to troubleshoot the problem. The fixes published so far have had no effect in my environment.

Best regards,

—K

Answer 3

Hello Kel Koop,

maybe you need to post your question in the Q&A forum, where there will be a dedicated engineer to provide you with a professional and effective response.

Here is a link to the Q&A forum: https://learn.microsoft.com/en-us/answers/questions/