0

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors.

I did some troubleshooting around the internet and found out that I should stop auditing a lot of this stuff. I tried creating a batchfile with a few commands like below:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable

There are several other lines, but that was the first.

On the 1st DC I tried that line on, the command prompt started a very rapid infinite loop just entering that command over and over. Ctrl-C brings up "terminate batch job (Y/N)?" after a few minutes allowing me to stop the loop.

Now, when I try running ANY 'auditpol' command no matter what it is (for example: auditpol /get /category:* or auditpol /? ), it repeats the set command listed ABOVE in an infinite loop again.

I've rebooted the server 3 times, and the command still seems to be locked in somewhere and always comes back no matter what I've tried. I haven't touched the other DCs yet, because I don't want to cause problems on them until this one is straightened out.

Any assistance will be appreciated.

Chris
  • 1
  • 1

1 Answers1

0

Did you create a batch file and name it "auditpol.cmd"? If so, then that is most likely the problem, since the script will just keep calling itself recursively. I can't see any other reason as to why what you are describing would be happening.

What happens if you bring up task manager and terminate the auditpol.exe command?

Lucky Luke
  • 1,634
  • 1
  • 11
  • 12