Eventviewer ; id=1108

Anonymous
2022-10-17T15:58:19+00:00

After every reboot , we get id=1108 in the eventviewer , how (?) to stop these errors ?

There are everytime 20 errors , with id=1108 .

How to get rid of it??

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Ramesh 181.8K Reputation points Volunteer Moderator
2022-12-04T05:01:36+00:00

On my system, the 1108 events stopped after updating to 22621.900.

But, some 4688 (Process creation event) entries are appearing now.

From November 29, 2022—KB5020044 (OS Build 22621.900) Preview:

"It addresses an issue that affects process creation. It fails to create security audits for it and other related audit events."

Was this answer helpful?

0 comments

63 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-22T09:56:26+00:00

    Hi Sponselee,

    Ok. Let the entries gather for 2-3 days. Once we get to know the pattern/timing of those entries, we'll run a fresh trace accordingly.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2022-10-22T09:49:25+00:00

    Yes , sorry , forgot to mentioning ; made a task for cleaning eventlogs after 1 hour , after every reboot.

    I ended this task , so everything will be saved.

    You will see all these errors ,id=1108, after every reboot , they are all the same !

    Like I reported in my previous post.

    Please, dont give up , we spended so much time for solving it.

    My mistake , had to finish the clean-eventlog task .

    Will wait for answer.

    fr.gr.P.Sponselee

    Was this answer helpful?

    0 comments
  3. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-22T09:33:38+00:00

    The event log seems to have been cleared. There is no way for me to correlate the data with the boot log.

    Image

    whereas the boot log ended at 1:29 PM (My TZ is IST, BTW).

    Image

    And if I look at the Security Event log you uploaded, it's also cleared.

    There is absolutely no way for me to find the pattern of the events. Sorry.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2022-10-22T09:26:38+00:00

    They arrive after every reboot , 20 times after each other .

    10 different from the other ten . Please, look at the screenshots , they are all the same after every reboot, every day , since the upgrade to 22H2 , they were not generated in 21H2 !

    Subscription of the errors , again 20 times ; " An error occurred while processing an incoming event published from Microsoft-Windows-Security-Auditing. "

    First one ; id=1108, errorcode=15005 , EventID=0

    Second one ; id=1108 , errorcode=15003 , EventID=4688

    and so on ( 20 times )

    All generated by the ; PublisherID Microsoft-Windows-Security-Auditing

    Im in the Netherlands , 11.20 in the morning now.

    Please look in these uploads ; Security and System ; https://www.upload.ee/files/14605189/Security.evtx.html https://www.upload.ee/files/14605194/System.evtx.html

    Will wait for your answer....

    fr.gr.

    P.Sponselee

    Was this answer helpful?

    0 comments