Microsoft-Windows-Security-Auditing Event#1108 Errors?

Zardoc · Oct 20, 2022

Hi,Temporary fix like the VSS thingny

Save this to XML and import in task manager: In the general tab, change the user ID to your user ID.

?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2009-10-08T20:36:07.2476481</Date>
<Author>harley\Zardoc</Author>
<URI>\Viewer</URI>
</RegistrationInfo>
<Triggers />
<Principals>
<Principal id="Author">
<UserId>S-1-5-21-1345786735-719698855-697502571-1001</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"D:\Win 11 Viewer.bat"</Command>
</Exec>
</Actions>
</Task>

You will also need the .bat command. You can see in the XML, I placed it in the root of my D drive (<Command>"D:\Win 11 Viewer.bat"</Command>).

You can change location in the xml before you import to task manager.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit

Task man, Task man, OHH what a relief it is!! :lmao:

pietcorus2 · Oct 20, 2022

Yes, my event-clean task starts 1 hour after every reboot .
So , plenty time to have a look into the viewer , if needed.............! :wink:

Zardoc · Nov 19, 2022

Hi all, after nagging MS for a while, with Preview build 22621.898 I can safely say that Event 1108 errors, 6155 & event 15 errors are not showing anymore.

Can someone please verify ?

Thanks

pietcorus2 · Nov 20, 2022

Good news !
Remains the question ; how (?) to get rid of this id garbage in the stable version...........? :wink:

KevTech · Nov 21, 2022

Zardoc said:
Can someone please verify ?

Still had the 6155 errors.

pietcorus2 · Nov 21, 2022

No id=1108 anymore ................??

Cromax · Nov 21, 2022

Its on Preview ring not on stable yet.

Zardoc · Nov 21, 2022

KevTech said:
Still had the 6155 errors.

Yep, 6155 event and 360 event still there. I have 10 6155 and only one 360.

1108 is a no show with build 22621.898

Simbiat · Mar 22, 2023

Registered specifically to share this bit of info, since even MS Forums somehow missed this:

If you are seeing LSA errors for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence.

I have not found a way to learn what is actually triggering these libraries/protocols, and what can be done to disable them, if that is safe enough for a particular system (because if they are in use, disabling them may affect other apps).

Globespy · Apr 13, 2024

I know an old thread, but I've been having a lot of BSOD while gaming, so this problem is now impacting the use of my computer.
There's nothing in the minidump that would indicate problems with drivers or hardware.
Disgusting that this is still not resolved.
23H2 OS Build 22631.3447

Oh, and I'm also getting this:

I have a Win 11 Pro license, not a corporate/business license. I know this 100% because I used to work for Microsoft and as an alumni purchased the key from the official company store.
I found a fix for this one here:

how to disable Windows Hello for Business - Microsoft Q&A

I got this warning message on Event Viewer: Windows Hello for Business provisioning will not be launched. Device is AAD joined ( AADJ or DJ++ ): Not Tested User has logged on with AAD credentials: No Windows Hello for Business policy is enabled:…

answers.microsoft.com

UPDATE: This 'fix' does not work.

For the rest of the LSA/Wininit errors, I'm guessing a fresh install of Windows will not resolve any of these issues?
So I just have to put up with random BSOD?

Zardoc · Apr 14, 2024

@Globespy
Unfortunately, I submitted this issue time and time again to MS and nothing was done. I tried to disable but it's a complicated process and it will be re activated because it's a security setting. I haven't seen any areas that were affected by the messages.

I simply disabled event viewer messages to event 15, 6155, and 360.
Here are the reg commands:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{23b8d46b-67dd-40a3-b636-d43e50552c6d}]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\{199fe037-2b82-40a9-82ac-e1d46c792b99}]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}]
"Enabled"=dword:00000000

Microsoft-Windows-Security-Auditing Event#1108 Errors?

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer