LSASS memory crash due to Event ID 4663 flood after enabling file share auditing

Question

Enabled detailed file share auditing on the file server and it generated over 50,000 Event ID 4663 logs per minute causing lsass.exe to run out of memory and reboot the server, need to know how to filter object access audit policies using GPO

Answer 1

Hello,

The issue comes from enabling broad object access auditing, which logs every file access and floods LSASS with Event ID 4663 entries. The fix is to narrow the audit scope. In Group Policy, go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access and enable only “File System.” Then, on the file server, configure SACLs on specific folders rather than the entire volume. Use the Auditing tab in folder properties to define which users and which access types (like Write or Delete) should be logged. Avoid auditing “Everyone” with “All access” because that generates massive noise. You can also fine-tune with auditpol.exe, for example: auditpol /set /subcategory:"File System" /success:enable /failure:disable to reduce unnecessary events. The key is that GPO sets the category, but filtering is done at the SACL level. Best practice is to audit only sensitive directories and only critical access types, not every read. This will stop LSASS from exhausting memory and stabilize the server.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.