CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen

 Last reviewed: December 18, 1997
Article ID: Q178208
The information in this article applies to:
  • Microsoft Windows NT Workstation version 4.0
  • Microsoft Windows NT Server version 4.0

SYMPTOMS

Although the audit log is not full, your computer may stop responding (hang) when you shut down and report the following blue screen error message: 

   STOP 0xC0000244
   An attempt to generate a security audit failed

CAUSE

Windows NT attempts to report a logoff audit in the event log after the event log has shut down. As this audit attempt fails and CrashOnAuditFail is enabled, the system displays a blue screen error message that reports an audit failure.

RESOLUTION

You can work around this problem by disabling logon/logoff auditing.

To resolve this problem, obtain the following fix or wait for the next Windows NT service pack.

This fix should have the following time stamp: 

   12/02/97  08:25p               152,336 Lsasrv.dll   (Intel)
   12/02/97  08:16p               939,072 Ntkrnlmp.exe (Intel)

   12/02/97  08:22p               249,104 Lsasrv.dll   (Alpha)
   12/02/97  08:13p             1,399,680 Ntkrnlmp.exe (Alpha)

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information. 

Keywords          : kbbug4.00 kbfix4.00 NTSrvWkst ntstop
Version           : WinNT:4.0
Platform          : winnt
Issue type        : kbbug
Solution Type     : kbpatch

================================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: December 18, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.