Eventviewer ; id=1108

Anonymous
2022-10-17T15:58:19+00:00

After every reboot , we get id=1108 in the eventviewer , how (?) to stop these errors ?

There are everytime 20 errors , with id=1108 .

How to get rid of it??

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Ramesh 181.8K Reputation points Volunteer Moderator
2022-12-04T05:01:36+00:00

On my system, the 1108 events stopped after updating to 22621.900.

But, some 4688 (Process creation event) entries are appearing now.

From November 29, 2022—KB5020044 (OS Build 22621.900) Preview:

"It addresses an issue that affects process creation. It fails to create security audits for it and other related audit events."

Was this answer helpful?

0 comments

63 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2022-10-27T09:14:11+00:00

    Hi , here we go ;

    https://www.upload.ee/files/14617746/Security.evtx.html https://www.upload.ee/files/14617747/System.evtx.html https://www.upload.ee/files/14617748/Application.evtx.html

    Hope this will bring us to the solution of this ( very !) annoying id=1108 !

    fr.gr.P.Sponselee

    Was this answer helpful?

    0 comments
  2. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-26T16:56:30+00:00

    Hi,

    Thanks. Please upload these items:

    "C:\Windows\System32\winevt\Logs\System.evtx"

    "C:\Windows\System32\winevt\Logs\Security.evtx"

    "C:\Windows\System32\winevt\Logs\Application.evtx"

    Was this answer helpful?

    0 comments
  3. Anonymous
    2022-10-25T11:08:09+00:00

    Hi ,

    well we try again , did not removed anything from the viewer , so here are the files you asked for ;

    https://www.upload.ee/files/14613373/audit_legacy.txt.html

    and ;

    https://www.upload.ee/files/14613374/audit.txt.html

    " Open secpol.msc and set everything to "No auditing" on the Audit Policy page."...also done .

    Will wait for your conclusions ;

    fr.gr.P.Sponselee

    Was this answer helpful?

    0 comments
  4. Ramesh 181.8K Reputation points Volunteer Moderator
    2022-10-22T17:43:45+00:00

    Upon inspecting your security event logs, the Process tracking audit seems enabled, although you've cleared the audit policies by running the "auditpol.exe /clear" command.

    Please re-run these commands:

    • auditpol.exe /clear
    • auditpol.exe /get /category:* >c:\audit.txt
    • secedit.exe /export /areas SECURITYPOLICY /cfg c:\audit_legacy.txt
    • reg export "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" c:\eventlog.reg

    Upload C:\audit.txt, C:\audit_legacy.txt, and C:\eventlog.reg.

    Open secpol.msc and set everything to "No auditing" on the Audit Policy page.

    Image

    //A solution within a next WU-update , is possible still ( ?)//

    I think you may report this in the Feedback tool... it might get substantial upvotes.

    Was this answer helpful?

    0 comments