Event Type: Audit Failure

Anonymous
2016-06-30T20:24:37+00:00

Hi,

My System is Windows 7 SP1 Home Premium.  Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number     : 145537

Log Type          : Security

Event Type        : Audit Failure

Time              : 28/06/2016 18:57:39

Source            : Microsoft-Windows-Security-Auditing

Category          : 12290

Event ID          : 6281

User Name         :

Computer          : Chris-PC

Event Data Length : 0

Record Length     : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.    File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys 

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion.   Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive.  IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2016-07-31T03:11:24+00:00

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

Was this answer helpful?

0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-07-13T13:30:04+00:00

    Hi Ratandeep,

    You are a genius - I'm not sure how this worked but it certainly seems to have done the trick.

    I followed the clean boot instructions and found no problems showing in the Event viewer other than items relating to disabled services such as the Comodo Firewall.  As regards troubleshooting, well I was at a loss to know what to look for so I reset the computer for a normal restart half expecting the problem to show in the Event Viewer next time.  Well the problem didn't return at restart and so far, after half an hour it has not appeared.  Normally the the problem would have shown within the first five minutes or less from startup.

    Perhaps the way non- Microsoft services were disabled for the clean boot and then re-enabled for the normal start, was enough to do the trick.

    Anyway, I am very grateful to you and of course, the others who were so willing to give their time in helping me.  I am also grateful that you introduced me to the clean boot concept which I had heard of but never tried before - I have now filed the instructions for any possible future use.

    During the creation of this post, I have returned to the Event viewer several times just to make sure everything is OK and it is.

    Thanks again - we can now say this issue has been resolved.

    Regards.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-07-13T09:34:00+00:00

    Hello,

    Thank you for responding.

    I appreciate your concern.

    I hope that you may have tried updating drivers.

    However, you may perform clean boot and check if error re-appears.

    Refer this article:

    How to perform a clean boot in Windows

    https://support.microsoft.com/en-us/kb/929135

    Clean boot is performed to start Windows by using a minimal set of drivers and startup programs. This helps eliminate software conflicts that occur when you install a program or an update or when you run a program.

    Note: After you have finished troubleshooting, follow these steps from section “How to reset the computer to start as usual after clean boot troubleshooting” to reset the computer to start as usual.

    I hope this information helps.

    Thank you

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-12T19:09:54+00:00

    Hi Ankush,

    This is getting very confusing - I'm not sure which replies belong to what.

    I don't intend doing anything regarding the system's BIOS as I am sure the problem does not relate to that.   Though not in screenshot form, I have copied and pasted the text from the error reports in earlier posts so you would be able to see the details in those posts.

    My system is running with no real problems - perhaps I was too nervous about the integrity errors when they first appeared in the Event Viewer.  I've got used to them now and they cause me no worries - I would, however, be worried if I messed about with the BIOS.

    I do appreciate your interest and willingness to help but as a 75 year old, I don't want to get involved in things beyond my capabilities and playing with the BIOS might be just that bit too far.

    Best regards.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-12T12:48:10+00:00

    Give me a screenshot of the error report that you got.

    It will be a better understanding

    Was this answer helpful?

    0 comments