Event Type: Audit Failure

Anonymous
2016-06-30T20:24:37+00:00

Hi,

My System is Windows 7 SP1 Home Premium.  Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number     : 145537

Log Type          : Security

Event Type        : Audit Failure

Time              : 28/06/2016 18:57:39

Source            : Microsoft-Windows-Security-Auditing

Category          : 12290

Event ID          : 6281

User Name         :

Computer          : Chris-PC

Event Data Length : 0

Record Length     : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.    File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys 

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion.   Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive.  IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2016-07-31T03:11:24+00:00

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

Was this answer helpful?

0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-07-24T12:06:23+00:00

    Hi Ratandeep,

    Thanks for the link.  I have investigated the Windows Assessment Toolkit and see it is part of the Assessment and Deployment Kit (ADK) which is a rather large download as it contains WinPE and various additional tools.  I notice too, that when I search for a download for Windows 7, that only Windows 8.1 versions are listed.  In addition to this, further investigation has shown that some Windows 7 users have had problems.

    So, before I proceed, could you answer a few questions:

    1)     Although the ADK download is shown as for Windows 8.1, is it compatible with Windows 7?

    2)     Will the installer allow me to select only the Windows Assessment Toolkit to install or must I install the whole set? (I have downloaded the installer but have held back from continuing because firstly it is shown as Windows 8.1 and secondly it contains so many items I may not need).

    3)     Is there a way I can just download the Windows Assessment Toolkit for Windows 7 direct from Microsoft?

    4)     How would I use the Windows assessment Toolkit to investigate my code integrity problems as reported by the Event Viewer.

    Thanks and regards.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-07-24T05:24:36+00:00

    Hello,

    Thank you for responding.

    I am sorry for late reply.

    I appreciate your concern.

    You may also use "Windows Assessment Toolkit" and check.

    Refer:

    https://msdn.microsoft.com/en-us/library/windows/desktop/hh848076(v=vs.85).aspx

    Thank you

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-22T10:12:23+00:00

    Hi Ratandeep,

    I fully uninstalled both programs, reinstalled them and found the problem had not gone away.  It seems that the issue is within the Microsoft code integrity checking system which, unfortunately with my Windows 7 version, I have no access to. 

    Unless Microsoft are able to offer a means of editing the code integrity checking system, it appears we will just be going around in circles in trying to address this issue.  As I am suffering no noticeable problems running my system despite the Event Viewer warnings, perhaps it is time to call it a day.

    Thanks for all your help and advice.

    Regards.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-22T03:20:18+00:00

    Hello,

    Thank you for replying.

    You may uninstall both the software and check if Windows shows any errors.

    Refer:

    http://www.trusteer.com/en/support/uninstalling-rapport

    https://support.microsoft.com/en-us/kb/2601726

    Please keep us posted.

    Thank you

    Was this answer helpful?

    0 comments