Eventviewer ; id=1108

Anonymous
2022-10-17T15:58:19+00:00

After every reboot , we get id=1108 in the eventviewer , how (?) to stop these errors ?

There are everytime 20 errors , with id=1108 .

How to get rid of it??

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Ramesh 181.8K Reputation points Volunteer Moderator
2022-12-04T05:01:36+00:00

On my system, the 1108 events stopped after updating to 22621.900.

But, some 4688 (Process creation event) entries are appearing now.

From November 29, 2022—KB5020044 (OS Build 22621.900) Preview:

"It addresses an issue that affects process creation. It fails to create security audits for it and other related audit events."

Was this answer helpful?

0 comments

63 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2022-10-21T08:02:34+00:00

    Sir , nothing happens , after this command:

    auditpol /get /category:* >%temp%\audit.txt

    What to do .......??

    fr.gr.

    P.Sponselee

    Was this answer helpful?

    0 comments
  2. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-21T08:45:30+00:00

    Upload the file audit.txt located in the temp folder and upload to OneDrive.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2022-10-21T09:16:26+00:00

    Hi , did not open anything in CMD , but got this in temp-folder ;

    https://www.upload.ee/files/14602495/audit.txt.html

    Hope to know more soon ......

    fr.gr.P.Sponselee

    Was this answer helpful?

    0 comments
  4. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-21T12:13:33+00:00

    Hi Sponselee,

    The audit settings look fine. Please run this command from Admin CMD prompt:

    auditpol /backup /file:c:\auditpol.csv

    (Store this file in a safe location.)

    Then, run the following command:

    auditpol /clear

    See if that stops the logging of security event 1108.

    The above is not a final solution. It's a way to test if the audit settings are causing the issue.

    Was this answer helpful?

    0 comments