Windows Server 2019 and 2022 Security Event 521 Issues

Question

Windows Server 2019 and 2022 Security Event 521 Issues - We get this error in the security logs on all domain controllers, but the most events happen on the primary domain controller. We've increased the event log buffers to the max, no help. We have added the AutoBackup entries for the logs per forums, we've disabled third party agents on the servers, and the issue remains. We've used process monitor to try to align issues with processes, and we're not really connecting any dots.

We still don't know whether it's a buffer overflow condition, or, a permissions issue. Given all the steps that we've tried, we're leaning permissions but we can't be quite sure just yet.

Answer 1

Hello Jamie McFarling,

Thank you for posting in Microsoft Community forum.

Have you made any changes before the problem occurs?

You can try to restart the Domain Controllers during downtime and then check if it helps.

Here are two similar threads for your reference.

[8f4a-94ca-161-93c9] (microsoft.com)

[4ca6-9993-528-0d7e] (microsoft.com)

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

Thank you for your reply Daizy. Unfortunately, these aren't applicable because the event code is actually 0x80000005 and not 0xc0000008.

Answer 3

Hello Jamie McFarling,

Thank you for your reply.

You can try to reboot the DC that generated the event 521 if possible and then check if it helps.

Best Regards,
Daisy Zhou

Answer 4

Yes, I have rebooted all domain controllers... and the issue persists...

Answer 5

Hello Jamie McFarling,

Thank you for your reply.

Could you please provide one screenshot about event ID 521 with full "General" information?

Best Regards,
Daisy Zhou