STATUS_AUDIT_FAILED 0XC0000244: Fix the Audit Log Crash

Cause #1: The Audit Log Is Full or Corrupted

Most times you see 0xC0000244, it's because the Windows Security Event Log — the file that stores audit events — is either completely full or got corrupted. I had a client last month whose call center PC started throwing this error every time someone logged in. The log had hit its max size and Windows couldn't write to it, so it just gave up and refused to start the session properly.

The fix is to clear that log and reset its size. You'll need admin rights to do this.

How to clear the security log

1. Press Win + R, type eventvwr.msc, and hit Enter.
2. Expand Windows Logs and select Security.
3. Right-click Security and choose Clear Log….
4. Select Save and Clear if you need to keep a copy, or just Clear if you don't care.

That usually stops the error immediately. But if the log won't clear because it's corrupted, you'll need to delete the physical file. That's a different bag of worms, but here's the quick version:

net stop eventlog
# Delete the file: C:\Windows\System32\winevt\Logs\Security.evtx (use Explorer to delete it)
net start eventlog

Do that in an elevated command prompt. After restarting the Event Log service, Windows creates a fresh Security log. That's the nuclear option, but it works when the log is genuinely hosed.

Also, check the log size settings:

• Right-click Security in Event Viewer, select Properties.
• Set a reasonable max size like 128 MB or 256 MB.
• Choose Archive the log when full, do not overwrite events — that lets the system keep running when it fills up, instead of crashing.

If you're on a low-end machine with a small system drive, consider dropping to 64 MB. You rarely need more than that unless you're under active attack and need to follow every breadcrumb.

Cause #2: System Drive Is Out of Space

Here's a sneaky one. Windows can't write audit events if the system drive is full. I've seen this on a POS terminal that had a 32 GB SSD crammed with sales data. The audit log couldn't grow by even a few KB, so every audit attempt failed with 0xC0000244.

Free up space, and the error usually vanishes. Check disk space first:

dir C:\   # Look at the free space

If you're under 10% free on a small drive, that's your problem. Clean up temp files, uninstall junk, or run Disk Cleanup:

1. Open Start, type cleanmgr, and run it.
2. Select the system drive and let it scan.
3. Check Temporary files, Recycle Bin, and Windows Update Cleanup.
4. Click OK and delete.

Also, move the paging file or user folders to another drive if you're tight. But the quickest fix is just making sure you have at least 15-20% free space on the C: drive. Windows gets cranky below that, and audit failures are just one symptom.

One more thing: if the drive is an SSD that's been full for months, you might have TRIM issues causing slow performance. But that's a separate problem — for now, free the space and test the error.

Cause #3: Audit Policy Misconfiguration

Sometimes the audit policy itself is set to something Windows can't handle. For instance, if you've got audit settings that require a particular privilege, or a group policy that's forcing audit on a file location that no longer exists, you'll get this error.

I remember one server where the admin had enabled Audit Object Access on a folder that was later deleted. Every time something tried to access that path, the audit failed and threw 0xC0000244. We fixed it by clearing the SACL on that folder, but if you don't know which object is causing it, you can reset the whole audit policy to defaults.

Reset audit policy to defaults

secedit /configure /db secedit.sdb /cfg %windir%\inf\defltbase.inf /areas SECURITYPOLICY

That resets all security policy settings, including audit policies, to the Windows defaults. Run it in an elevated command prompt, then reboot. This is a blunt instrument, so use it only if you're comfortable losing custom audit settings.

If you want to be more surgical, open Local Security Policy (secpol.msc), go to Security Settings → Local Policies → Audit Policy and make sure each audit category is set to Success, Failure or No auditing — never leave one as Not Defined if you're having problems. Not Defined can cause weird behavior because it inherits from the parent, and if the parent is misconfigured, you're stuck.

Also check Advanced Audit Policy Configuration under the same snap-in. If you have overlapping settings between legacy and advanced policies, Windows can get confused. Pick one — I recommend the advanced one if you're already using it — and disable the other.

Quick Reference Table

That's the playbook. Start with the log clear — 9 times out of 10 that's all you need. If not, check disk space, then look at the policy. You'll have that error gone in under an hour, even if you're not a sysadmin.