Event Type: Audit Failure

Anonymous

Hi,

My System is Windows 7 SP1 Home Premium. Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number : 145537

Log Type : Security

Event Type : Audit Failure

Time : 28/06/2016 18:57:39

Source : Microsoft-Windows-Security-Auditing

Category : 12290

Event ID : 6281

User Name :

Computer : Chris-PC

Event Data Length : 0

Record Length : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error. File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion. Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive. IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

0 comments

60 additional answers

Anonymous

2016-07-26T10:07:39+00:00

Hi Ratankeep,

Your previous post provided a link that is potentially helpful but I have a lot of reading to do in order to collate and make sense of all the links you have provided. I think know is the time for me to see what I can do for myself using all that information you have provided.

I will now set my original post to stop emails so you won't feel obliged to continue your efforts on my behalf but rest assured your efforts have been greatly appreciated. Thanks to you, I have access to a lot of facilities I wasn't previously aware of and even though I have yet to resolve the original problem, I feel better able to cope in my endeavours.

So many thanks Rantankeep, you have been steadfast and determined, readily returning to this thread to offer help and suggestions.

Best regards.
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-26T09:28:52+00:00

Hello,

Thank you for your reply.

I hope that you found the information provided in the previous post as helpful.

Thank you
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-26T09:22:51+00:00

Thank you Ratankeep
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-26T08:18:22+00:00

Hello,

Thank you for responding.

You may also refer this article:

https://technet.microsoft.com/en-us/library/dd772712%28WS.10%29.aspx?f=255&MSPPError=-2147217396

Thank you
Was this answer helpful?

0 comments No comments