Event Type: Audit Failure

Anonymous
2016-06-30T20:24:37+00:00

Hi,

My System is Windows 7 SP1 Home Premium.  Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number     : 145537

Log Type          : Security

Event Type        : Audit Failure

Time              : 28/06/2016 18:57:39

Source            : Microsoft-Windows-Security-Auditing

Category          : 12290

Event ID          : 6281

User Name         :

Computer          : Chris-PC

Event Data Length : 0

Record Length     : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.    File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys 

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion.   Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive.  IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2016-07-31T03:11:24+00:00

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

Was this answer helpful?

0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-08-08T06:09:01+00:00

    Hello,

    Thank you for acknowledging my reply.

    I hope that you may not have any issues with Windows.

    Please feel free to reply, if you have any other concerns related to Windows.

    Thank you

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-08-07T07:14:45+00:00

    This is to confirm that the issue reported in my original post in this thread is resolved.

    I have not been able to establish what caused the problem in the first place but through dealing with another issue as explained in my previous post, by coincidence, the code integrity warning is no longer appearing in the Event Viewer.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-30T13:39:32+00:00

    Hi Ratandeep and others who responded to my earlier posts,

    This is an update of my situation.  While I do not wish to count my chickens before they are hatched, there seems to have been a positive development regarding the code integrity problem and all because of an Avast Anti-Virus program update issue.

    The latest Avast program update (not one of the frequent automatic virus definitions updates) did not complete correctly.  After the system reboot, which is required after an Avast program update, the Avast icon in the system tray included a red arrow and a message appeared to say the system was not protected.  I ran the repair option in Programs and Features; this ran smoothly and claimed all was OK but did not resolve the situation.  I found out later that the update is bugged but the problem is just one relating to the GUI which does not recognise that the shields are on when in fact they are.  Avast are working to correct the situation.

    So how does this relate to my code integrity problem?  Well, before I realised the Avast problem was a bug in the Avast program update and not something wrong with my system, in trying to use options in Avast to try to sort the Avast problem, my computer locked up and I resorted to a hard power off.  This resulted in a warning screen at the next bootup which offered a number of options including 'Boot normally' and 'System Repair - leaving personal files alone' (or words to that effect).  I chose the latter and and allowed the process to complete.  After rebooting, Avast had slipped back to the previous program version and there were no more security warnings.  Later, when I checked the Event Viewer, the code integrity warning was not included and has not reappeared in several restarts since.  Let's hope it stays that way.

    While I do not believe the problem was directly related to Avast, a series of coincidences led to me using System Repair which, hopefully, has managed to sort the code integrity issue where Chkdsk was unable.  I will report back if the situation changes but hope that at last I will be able to declare my problem as resolved.

    Thanks for your patience and help.  Regards to all.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-26T10:24:55+00:00

    Hello,

    Thank you for the appreciation.

    I appreciate it.

    Please feel free to reply, if you have any other concerns about Windows.

    Thank you

    Was this answer helpful?

    0 comments