Event Type: Audit Failure

Anonymous

Hi,

My System is Windows 7 SP1 Home Premium. Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number : 145537

Log Type : Security

Event Type : Audit Failure

Time : 28/06/2016 18:57:39

Source : Microsoft-Windows-Security-Auditing

Category : 12290

Event ID : 6281

User Name :

Computer : Chris-PC

Event Data Length : 0

Record Length : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error. File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion. Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive. IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

0 comments

60 additional answers

Anonymous

2016-07-12T09:33:20+00:00

A number of responses altogether - the time and trouble taken on my behalf is much appreciated so thank you all.

Rantandeep: Thanks for the link - it is both informative and useful but also frustrating as Windows 7 Home Premium doesn't provide or allow a means of access to edit group policy. It looks like I'll have to live with the problem - it doesn't impinge on the normal running of my system so the hassle of restoring from an old image backup file is hardly worthwhile.

Ankush: Thanks for your contribution. I agree the error is not a crucial one but in my case it is not related to a heating issue as all checks show the temperatures all within the acceptable tolerances. I am inclined to agree with Ratandeep in his reply to you and will leave the BIOS well alone.

ElderN: You have done me proud in your efforts on my behalf. Your research would seem to go along with my feelings that I might just have to live with the issue. It would appear to merely cosmetic in as far as running my system is concerned.

Perhaps this thread should be closed as unresolved as there seems to be no solution for such a problem in Windows 7 Home Premium. Unless the technical people at Microsoft accept there is a problem and provide a solution, there cannot be any progress. However, are they going to be interested in Windows 7 Home Premium when they are pushing us to upgrade to Windows 10 which is not a route viable for me with this computer?
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-12T08:07:32+00:00

I checked and the Audit policies that IBM is telling you to "turn off":

5.Verify both check-boxes are unchecked.

Those policies are disabled/turned off/no check in the box by default:

So unless they somehow got enabled (maybe installing their software enables them) they should not be enabled/turned on in the first place.

Then I checked some more to see (if they were somehow enabled) how to disable them without using secpol or Group Policy Editor - essentially how to remove the policies from the section in the registry where polices are stored.

Of course those policy settings are no where to be found because:

Audit Policy security settings are not registry keys.

That section of the registry where policies are stored is the same for all Windows versions - some versions just don't give you the tools to manipulate them but you can still manipulate polices directly through the registry - but not audit policies.
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-12T08:07:09+00:00

Hello Ankush,

Thank you for your input.

I appreciate it.

However, modifying BIOS/ complementary metal oxide semiconductor (CMOS) settings incorrectly can cause serious problems that may prevent your computer from booting properly. Microsoft cannot guarantee that any problems resulting from the configuring of BIOS/CMOS settings can be solved. Modifications of the settings are at your own risk.

Thank you
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-12T07:51:31+00:00

Hi,

This error that you saw in event viewer is not very critical error. As this error is mostly referred to heating issue which causes you computer or laptop to restart or shutdown unexpectedly while you are working on the computer system.

This issue is mostly resolved by updating the latest update of BIOS of your computers hardware which makes the functioning of the fan stable and this issue gets resolved.

Please revert if this doesn't resolve.

Regards.
Was this answer helpful?

0 comments No comments