Event ID: 1101
Audit Events Have Been Dropped By The TransportAudit events have been dropped by the transport. %1
This event is logged when Windows is dropping audit events. This can happen under normal (during a reboot, high system load) or abnormal circumstances (malicious activity).
Auditing:
Always
Volume:
Low
CJIS 5.4.1.1.5.c
ISO 27001:2013 A.12.4.2
PCI 3.2.1: 10.2.3
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Other System Events"
LEFT/RIGHT arrow keys for navigation
Back to List