Microsoft-Windows-Security-Auditing Event#1108 Errors?

Globespy · Jul 28, 2022

Been getting a ton of these lately and hoped someone might be able to help me figure out why and how to fix?
"The event logging service encountered an error while processing an incoming event published from Microsoft-Windows-Security-Auditing."

These events always seem to be preceded by another error:
"Credential Guard and/or VBS Key Isolation are configured but the secure kernel is not running; continuing without them."

I recently installed a discrete TPM 2.0 module on my Gigabyte X570 motherboard as I was tired of the infamous Ryzen 'Stutters/Freezes' that Gigabyte have yet to properly address even with their latest AGESA 1.2.0.7 beta BIOS update - apparently this is a Gigabyte issue with other board manufacturers seeming to resolve issues regarding this issue.
Before installing the module I disabled the fTPM built into the Ryzen 5800X3D CPU, powered down the PC and installed the module, before then going back into BIOS and seeing the module setup.

Appreciate any help.
Thanks!

FreeBooter · Jul 28, 2022

The event logging service encountered an error - Windows 10

Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1.

docs.microsoft.com

Event ID 1108 Microsoft-Windows-Security-Auditing on Windows Server 2012 R2

social.technet.microsoft.com

glasskuter · Jul 28, 2022

It's not like MS doesn't know about it. The web has thousands of complaints going back to 2020.. It is all part of Microsoft's "Gaming Services". Be glad you are getting events without freezes, restarts, and even BSOD relating to this as that is what's happening to a lot of people. (From what I can tell, these more critical reports are from gamers whose game depends on GameInput to run.) It appears your game will run without it as it says its continuing.

Zardoc · Aug 12, 2022

Hi, is this the full event viewer? do you have a 360 event?

All of this seems to be related to Windows defender credential guard which activates usually on enterprise systems and probably on volume licenses. The problem is that the issue is not consistent. Some users are running Pro versions and getting the error which contradicts what MS is saying.

Cromax · Aug 24, 2022

have same errors and cant get rid off it

pietcorus2 · Sep 22, 2022

Yes, even in latest Win11 , how to stop these events ................???

Juergen · Sep 23, 2022

I updated to Windows 11 22H2 Build 22621.521 and have the exact same errors.
I can't find a solution to the problem anywhere.

Coolmistry · Sep 23, 2022

+1 same here.......

pietcorus2 · Sep 23, 2022

id=1108 is coming out of my roof............!

Zardoc · Sep 23, 2022

What's more frustrating here is that there are 4 related events Windows hello for business messages (event 360) accompanied by LSA errors (event 6155), Wininit (event 15) errors and multiple Event viewer errors (event 1108 Security auditing). All of this is related to credential guard.

The peeve here is that this is security related. Not like the nagging VSS errors (@pietcorus2 get it?

)

pietcorus2 · Sep 24, 2022

Only event 1108 Security auditing keeps filling my EventLog !
Even " {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148} " disabling does not work , appreciate some help , HOW( ??) to get rid of it ............
Never had this in previous Win-version............

Zardoc · Sep 24, 2022

pietcorus2 said:
Only event 1108 Security auditing keeps filling my EventLog !
Even " {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148} " disabling does not work , appreciate some help , HOW( ??) to get rid of it ............
Never had this in previous Win-version............

You can't disable it. It's a general event related to a whole bunch of stuff. The key is in at least 4 or 5 different WMI categories.

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Setup]
"OwningPublisher"="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"
"Enabled"=dword:00000000
"Isolation"=dword:00000000
"ChannelAccess"="O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}]
"Enabled"=dword:00000000
"EnableLevel"=dword:00000000
"Status"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}\Filters]
"Enabled"=dword:00000001
"EventIdFilterIn"=dword:00000001
"EventIds"=hex:4e,04,68,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}]
"Enabled"=dword:00000000
"EnableLevel"=dword:00000000
"LoggerName"="EventLog-Application"
"MatchAnyKeyword"=hex(b):00,00,00,00,00,00,00,20
"MatchAllKeyword"=hex(b):00,00,00,00,00,00,00,00
"EnableProperty"=dword:00000001
"Status"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}]
"Enabled"=dword:00000000
"EnableLevel"=dword:00000000
"LoggerName"="EventLog-System"
"MatchAnyKeyword"=hex(b):00,00,00,00,00,00,00,80
"MatchAllKeyword"=hex(b):00,00,00,00,00,00,00,00
"EnableProperty"=dword:00000001
"Status"=dword:00000000

I can disable (event 360) accompanied by LSA errors (event 6155), Wininit (event 15) errors but you can't disable multiple Event viewer errors (event 1108)

Again, what is the common link to those errors? I have not been able to find it.

The other troubling thing is that I tried every way imaginable to disable Hello for business and credential guard (group policy, registry, command line). There is nothing that can be done (at least I can't find a solution).

This is bad because you don't know how it's affecting your security settings.

I clean installed and on first boot I had the error. Is the motherboard the problem (Not sure but I disabled secure boot and all the bells and whistles), is the account type the problem (nope used a local account).

I hope MS solves this, but we aren't a large group and I've seen nothing acknowledging the problem or eventual fix.

pietcorus2 · Sep 24, 2022

Zardoc said:
You can't disable it. It's a general event related to a whole bunch of stuff. The key is in at least 4 or 5 different WMI categories.

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Setup] "OwningPublisher"="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" "Enabled"=dword:00000000 "Isolation"=dword:00000000 "ChannelAccess"="O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)" "Type"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}] "Enabled"=dword:00000000 "EnableLevel"=dword:00000000 "Status"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}\Filters] "Enabled"=dword:00000001 "EventIdFilterIn"=dword:00000001 "EventIds"=hex:4e,04,68,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}] "Enabled"=dword:00000000 "EnableLevel"=dword:00000000 "LoggerName"="EventLog-Application" "MatchAnyKeyword"=hex(b):00,00,00,00,00,00,00,20 "MatchAllKeyword"=hex(b):00,00,00,00,00,00,00,00 "EnableProperty"=dword:00000001 "Status"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}] "Enabled"=dword:00000000 "EnableLevel"=dword:00000000 "LoggerName"="EventLog-System" "MatchAnyKeyword"=hex(b):00,00,00,00,00,00,00,80 "MatchAllKeyword"=hex(b):00,00,00,00,00,00,00,00 "EnableProperty"=dword:00000001 "Status"=dword:00000000

I can disable (event 360) accompanied by LSA errors (event 6155), Wininit (event 15) errors but you can't disable multiple Event viewer errors (event 1108)

Again, what is the common link to those errors? I have not been able to find it.

The other troubling thing is that I tried every way imaginable to disable Hello for business and credential guard (group policy, registry, command line). There is nothing that can be done (at least I can't find a solution).

This is bad because you don't know how it's affecting your security settings.

I clean installed and on first boot I had the error. Is the motherboard the problem (Not sure but I disabled secure boot and all the bells and whistles), is the account type the problem (nope used a local account).

I hope MS solves this, but we aren't a large group and I've seen nothing acknowledging the problem or eventual fix.

Yes , must be one of the ( many) bugs after this new upgrade .
Solution is hard to find , only thing you can do is cleaning your eventlog once in a wile...........
btw; not possible to disable WMI ( completely or partial ) ?

KevTech · Sep 24, 2022

Zardoc said:
The other troubling thing is that I tried every way imaginable to disable Hello for business

Try this for Hello.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{23b8d46b-67dd-40a3-b636-d43e50552c6d}]

Change enabled to 0.

Zardoc · Sep 24, 2022

pietcorus2 said:
Yes , must be one of the ( many) bugs after this new upgrade .
Solution is hard to find , only thing you can do is cleaning your eventlog once in a wile...........
btw; not possible to disable WMI ( completely or partial ) ?

WMI is a big toy, Disabling it can cripple a bunch of stuff. The problem with this stuff is that it secures your system but it also makes it harder for you to see who's looking into it.

Apparently, DEV 25201 and up has fixed the issue. Will look to see.

pietcorus2 · Sep 24, 2022

" Apparently, DEV 25201 and up has fixed the issue. Will look to see. ".............this means its a bug for sure !
Never had this problem in previous version , MS will fix it ( someday ?!)
Anyway my rig seems not to have any problems , booting fast and runs fine , I can wait..........

btw; (maybe a stupid question) possible to migrate the regfiles , of this item , from a machine without these errors ??

pietcorus2 · Sep 25, 2022

No solution still.................should I go back to previous 21H2 ??
In 21H2 my Eventviewer used to be clean !

Cromax · Sep 25, 2022

Probably wont be fixed for long time its a bug.. and ms doesnt care if everything works

Zardoc · Sep 25, 2022

pietcorus2 said:
btw; (maybe a stupid question) possible to migrate the regfiles , of this item , from a machine without these errors ??

No, don't do that. The security issues are linked to the account. A lot of reg files are the same but some have an ID linked to machine. All you need is one wrong reg key, and you'll crash and burn.

pietcorus2 · Sep 26, 2022

" No, don't do that "............I see !
Well , made a task for this buggy id=1108 ; cleaning Eventlog after ten minutes after each reboot.
Will wait for a fix ..............