Microsoft-Windows-Security-Auditing Event#1108 Errors?


Hi,Temporary fix like the VSS thingny ;-)

Save this to XML and import in task manager: In the general tab, change the user ID to your user ID.
?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2009-10-08T20:36:07.2476481</Date>
<Author>harley\Zardoc</Author>
<URI>\Viewer</URI>
</RegistrationInfo>
<Triggers />
<Principals>
<Principal id="Author">
<UserId>S-1-5-21-1345786735-719698855-697502571-1001</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"D:\Win 11 Viewer.bat"</Command>
</Exec>
</Actions>
</Task>

You will also need the .bat command. You can see in the XML, I placed it in the root of my D drive (<Command>"D:\Win 11 Viewer.bat"</Command>).

You can change location in the xml before you import to task manager.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit
Task man, Task man, OHH what a relief it is!! :lmao:
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Intel® Core™ i9-12900K Desktop Processor 16 (8P+8E)
    Motherboard
    Asus TUF Gaming Z790-PLUS WIFI D4
    Memory
    G.Skill Ripjaws V Series 32gb (2x16gb) DDR4 3200mhz
    Graphics Card(s)
    Asus Dual Geforce Rtx™ 3060 TI Edition 8gb Gddr6
    Monitor(s) Displays
    BenQ EW3270U 31.5” 3840x2160 UHD 16:9 HDR LED 4K LG 27UK850-W 27'' 4K UHD IPS LED Monitor with HDR10
    Screen Resolution
    3840x2160
    Hard Drives
    Samsung 990 with heatsink PRO PCIe 4.0 Gen 4 NVMe® SSD 1TB
    WD_BLACK SN850X NVMe M.2 2280 1TB PCI-Express 4.0
    Crucial T500 2TB Gen4
    Samsung 970 Evo M.2 2280 2tb Pcie Gen3. X4
    PSU
    Corsair AXi Series AX860i Digital 860W 80 PLUS PSU
    Case
    Fractal Meshify C ATX Mid Tower Case
    Keyboard
    Logi MX Keys
    Mouse
    Logi M705
    Internet Speed
    400 mbs
    Browser
    Firefox
    Antivirus
    Eset NOD32
    Other Info
    Love fast boots
Yes, my event-clean task starts 1 hour after every reboot .
So , plenty time to have a look into the viewer , if needed.............! :wink:
 

My Computer

System One

  • OS
    Windows11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Asus
    CPU
    i7
    Motherboard
    z97k
    Memory
    32GB
    Graphics Card(s)
    nVidia
    Sound Card
    Realtek
    Hard Drives
    3
    Cooling
    air
Hi all, after nagging MS for a while, with Preview build 22621.898 I can safely say that Event 1108 errors, 6155 & event 15 errors are not showing anymore.

Can someone please verify ?

Thanks
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Intel® Core™ i9-12900K Desktop Processor 16 (8P+8E)
    Motherboard
    Asus TUF Gaming Z790-PLUS WIFI D4
    Memory
    G.Skill Ripjaws V Series 32gb (2x16gb) DDR4 3200mhz
    Graphics Card(s)
    Asus Dual Geforce Rtx™ 3060 TI Edition 8gb Gddr6
    Monitor(s) Displays
    BenQ EW3270U 31.5” 3840x2160 UHD 16:9 HDR LED 4K LG 27UK850-W 27'' 4K UHD IPS LED Monitor with HDR10
    Screen Resolution
    3840x2160
    Hard Drives
    Samsung 990 with heatsink PRO PCIe 4.0 Gen 4 NVMe® SSD 1TB
    WD_BLACK SN850X NVMe M.2 2280 1TB PCI-Express 4.0
    Crucial T500 2TB Gen4
    Samsung 970 Evo M.2 2280 2tb Pcie Gen3. X4
    PSU
    Corsair AXi Series AX860i Digital 860W 80 PLUS PSU
    Case
    Fractal Meshify C ATX Mid Tower Case
    Keyboard
    Logi MX Keys
    Mouse
    Logi M705
    Internet Speed
    400 mbs
    Browser
    Firefox
    Antivirus
    Eset NOD32
    Other Info
    Love fast boots
Good news !
Remains the question ; how (?) to get rid of this id garbage in the stable version...........? :wink:
 

My Computer

System One

  • OS
    Windows11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Asus
    CPU
    i7
    Motherboard
    z97k
    Memory
    32GB
    Graphics Card(s)
    nVidia
    Sound Card
    Realtek
    Hard Drives
    3
    Cooling
    air
No id=1108 anymore ................??



 

My Computer

System One

  • OS
    Windows11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Asus
    CPU
    i7
    Motherboard
    z97k
    Memory
    32GB
    Graphics Card(s)
    nVidia
    Sound Card
    Realtek
    Hard Drives
    3
    Cooling
    air
Its on Preview ring not on stable yet.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    -
    CPU
    4770k
    Motherboard
    Asus Maximus Formula VI
    Memory
    16 gb Kingston
    Graphics Card(s)
    2070 super
Still had the 6155 errors.
Yep, 6155 event and 360 event still there. I have 10 6155 and only one 360.

1108 is a no show with build 22621.898
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Intel® Core™ i9-12900K Desktop Processor 16 (8P+8E)
    Motherboard
    Asus TUF Gaming Z790-PLUS WIFI D4
    Memory
    G.Skill Ripjaws V Series 32gb (2x16gb) DDR4 3200mhz
    Graphics Card(s)
    Asus Dual Geforce Rtx™ 3060 TI Edition 8gb Gddr6
    Monitor(s) Displays
    BenQ EW3270U 31.5” 3840x2160 UHD 16:9 HDR LED 4K LG 27UK850-W 27'' 4K UHD IPS LED Monitor with HDR10
    Screen Resolution
    3840x2160
    Hard Drives
    Samsung 990 with heatsink PRO PCIe 4.0 Gen 4 NVMe® SSD 1TB
    WD_BLACK SN850X NVMe M.2 2280 1TB PCI-Express 4.0
    Crucial T500 2TB Gen4
    Samsung 970 Evo M.2 2280 2tb Pcie Gen3. X4
    PSU
    Corsair AXi Series AX860i Digital 860W 80 PLUS PSU
    Case
    Fractal Meshify C ATX Mid Tower Case
    Keyboard
    Logi MX Keys
    Mouse
    Logi M705
    Internet Speed
    400 mbs
    Browser
    Firefox
    Antivirus
    Eset NOD32
    Other Info
    Love fast boots
Registered specifically to share this bit of info, since even MS Forums somehow missed this:

If you are seeing LSA errors for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence.

I have not found a way to learn what is actually triggering these libraries/protocols, and what can be done to disable them, if that is safe enough for a particular system (because if they are in use, disabling them may affect other apps).
 

My Computer

System One

  • OS
    Windows 11 Prod x64

Latest Support Threads

Back
Top Bottom