Microsoft-Windows-Security-Auditing Event#1108 Errors?

pietcorus2 · Sep 28, 2022

" Apparently, DEV 25201 and up has fixed the issue. Will look to see. "................did you found a solution , which we can use in 22H2...................?

Zardoc · Sep 28, 2022

No, I have to join the dev team and I don't want that. Some users are having trouble leaving the dev channel.

pietcorus2 · Sep 28, 2022

I see........ will have to wait for solution still , in 21H2 did not have these id=1108 ...............so, have to clean the eventviewer on regular base .
Wondering if Windows will clean the eventviewer on regular base , or we have to use our " clean task " , we made .
What do you sugest/advice...........??

pietcorus2 · Oct 1, 2022

Still not fixed , after latest update !
This is how my eventviewer looks , after each reboot ;

And after clean-bat ( ten minutes after reboot) ;

Zardoc · Oct 1, 2022

This is an unknown issue for a lot of users. No one seems to be able to explain to what it's related or they don't have the time to reply.

I've seen a lot of issues in my years and this one is NOT like VSS which can be explained and ignored for known reasons.

This is a security audit issue. What is affected? What's the root cause ? I have an idea what it might be related to and posted on the MSDN forum to see if I could get a clue but I'm still waiting.

I didn't create an auto log cleaner because it takes 10 seconds to clear with event cleaner so I'm more worried about the scope and the consequences of the credential guard rather than how to remove the errors from event viewer although it is a pain having a bunch of the same errors.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit

Zardoc · Oct 1, 2022

I was able to login to DEV channel and the
(Event ID 1108: Microsoft-Windows-Security-Auditing) and
the (Event ID 15: Wininit Windows Defender Credential Guard (LsaIso.exe)
are gone.

Event Viewer Dev Build 25211.1001 2022-10-01.png

However, the 2 other events are present but seem to align with the fact that credential guard is not activated
(Event ID 360: Windows hello for business)
(Event ID 6155: LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard.),

is gone. However, I still have the Hello business

So let's hope it's a sign that the next 22H2 build will have a fix.

pietcorus2 · Oct 2, 2022

" credential guard is not activated "..............HOW(?) to deactivate it ??

Zardoc · Oct 2, 2022

pietcorus2 said:
" credential guard is not activated "..............HOW(?) to deactivate it ??

Are you getting LSA 6155 errors or any other error I mentioned in last post ?

In most cases, it's not activated. It's only with Enterprise versions that it's activated but the errors should not show with Pro or home versions because it's not activated by default.

I had an enterprise version before, but this is a Pro install but it's showing errors as if it was an Enterprise version.

The 1108 errors are associated with windows security settings so if you only have that, it could be something different.

pietcorus2 · Oct 2, 2022

" The 1108 errors are associated with windows security settings so if you only have that, it could be something different. ".......Yes, only id=1108 , did not occur in previous version .
I really want to get rid of these 1108 , its eating my eventviewer !
Tried several enabl/disable , no luck so far...........
Im almost certain , there must be a way to disable these 1108-items !
I wont give up , my previous eventviewer always clean , appreciate some help still........... :wink:

Zardoc · Oct 2, 2022

Or, you can do as I do, remain on 22000.1042

pietcorus2 · Oct 3, 2022

Zardoc said:
Or, you can do as I do, remain on 22000.1042

This annoying id=1108 is not worth going back to previous build..............
Im sure a fix will be found , someday !

Zardoc · Oct 3, 2022

pietcorus2 said:
This annoying id=1108 is not worth going back to previous build..............
Im sure a fix will be found , someday !

Like I mentioned, It's fixed in DEV build, so it will be fixed.

I just use Macrium to surf builds. When I'm satisfied, then I move to new build.
Besides, new build doesn't have much to offer besides Tabs and they aren't even activated everywhere.

pietcorus2 · Oct 3, 2022

id=1108 is related to ; {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148} .
Enable or disable does not fix the issue still !
Wonder if we can manipulate this key , maybe removing it or setting some/all values in it on 0...........
Will try...

Update ; even removing this key from regedit does not solve the id=1108 in eventviewer , it just keeps coming after every reboot !!

Zardoc · Oct 3, 2022

pietcorus2 said:
id=1108 is related to ; {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148} .
Enable or disable does not fix the issue still !
Wonder if we can manipulate this key , maybe removing it or setting some/all values in it on 0...........
Will try...

Update ; even removing this key from regedit does not solve the id=1108 in eventviewer , it just keeps coming after every reboot !!

There is more than one key. In fact 3 or 4., but it still won't fix the problem.

pietcorus2 · Oct 4, 2022

Zardoc said:
There is more than one key. In fact 3 or 4., but it still won't fix the problem.

In fact after every reboot ; 20 times id=1108 , no other ids ................!
Must be a 22H2-bug , coz its been reported several times by other forum-members also ..........

Wonder if MS removes this nonsense automaticly ( sometimes ?!) , or do we have to clean it ?
If so , whats the best way for cleaning it ( once a week or every day ?!)............?

pietcorus2 · Oct 4, 2022

Zardoc said:
There is more than one key. In fact 3 or 4., but it still won't fix the problem.

Which keys ? I sure want to know , maybe we will find the cullprit...............

pietcorus2 · Oct 6, 2022

FreeBooter said:
The event logging service encountered an error - Windows 10

Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1.

docs.microsoft.com

Event ID 1108 Microsoft-Windows-Security-Auditing on Windows Server 2012 R2

social.technet.microsoft.com

No working solution from this site............

Coolmistry · Oct 18, 2022

pietcorus2 said:
No working solution from this site............

Mmmmm It still not solves after I have upgraded new motherboard and I guess it do with Windows 11 issues!!

pietcorus2 · Oct 18, 2022

Coolmistry said:
Mmmmm It still not solves after I have upgraded new motherboard and I guess it do with Windows 11 issues!!

Yes, Im still searching for a solution to get rid of this crap , its eating my SSD !!

Coolmistry · Oct 18, 2022

pietcorus2 said:
Yes, Im still searching for a solution to get rid of this crap , its eating my SSD !!

Same here try figure out.... it so annoyed .......

Microsoft-Windows-Security-Auditing Event#1108 Errors?

Well-known member

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Well-known member

My Computer

Dazed & Confused

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Dazed & Confused

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer