Server 2022 - Unable to log events to security log

Question

I am upgrading some of my DCs to server 2022 currently. They are up and running just fine, but I continue to get Event ID 521 in my event viewer/monitoring software. I've tried a myriad of solutions found around online such as rebooting, deleting corrupted security log, expanding drive size etc. But I cannot get this issue fully fixed. Was curious if anyone has run into this specific issue and how they fixed it? Full log details below.

• Event Time: 16 Dec 2021 07:00:52 AM
• Source: Security
• Event Log: Security
• Type: Audit Success
• Event ID: 521
• Event User: NT AUTHORITY\SYSTEM
• Unable to log events to security log: Status code: 0xc0000078 Value of CrashOnAuditFail: 0 Number of failed audits: 1

Answer 1

Hi @Tyler J. Bennett

This issue may occur if the AutoBackupLogFiles key was not created. The best resolution is to disable login success.

Add registry keys AutoBackupLogFiles to the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\DNS Server

Value: AutoBackupLogFiles
Type: DWORD
Data value: Value not present or 0 (zero) equals "disabled." (This is the default.) Any non-zero value equals "enabled."

You must restart the computer or clear the corresponding event log before the new behavior takes effect.

Hope this resolves your Query!!

-------
--If the reply is helpful, please Upvote and Accept it as an answer--