Windows Event ID 4624 Repeating With Resource Not Available

loggingwindows

We've recently started logging 4624 event IDs on our domain controllers to help track user activity. Overall this has been fine, but recently started getting these messages over and over again.

Feb 20 00:00:54 dc01.domain.com
Microsoft-Windows-Security-Auditing[536]: 2015-02-20 00:00:52
c01.domain.com AUDIT_SUCCESS 4624 [The description for EventID 4624
from source Microsoft-Windows-Security-Auditing cannot be found: The
publisher has been disabled and its resource is not available. This
usually occurs when the publisher is in the process of being
uninstalled or upgraded.

I know our OPs team recently updated the servers but it is still occurring and I haven't found many references to how to stop this. Has anyone else come across these logs? Thanks.

Best Answer

Event 4624 is a notification that an account was successfully logged on.

As for the error message about the publisher being disabled, this is an error Microsoft has provided a fix for here. It's apparently an oops by a Windows Update--the Event Log Readers group has lost a registry permission.

To C&P from the "let me fix it myself" instructions (in case of link rot):

  1. Open Registry Editor. To do this, click Start, type regedit in the Start Search box, and then press Enter.
  2. Locate and then click the following registry keys:
  3. HKEY_LOCAL_MACHINES\System\CurrentControlSet\services\eventlog\Security\Microsoft-Windows-Security-Auditing
  4. Right click Microsoft-Windows-Security-Auditing in the left pane, and then click Permissions….
  5. Click the Add… button in the permission dialog.
  6. In the Enter the object names to select box, type Event Log Readers, and then click the Check Names button.
  7. Click OK to close all dialog windows.

(They also include standard disclaimers about editing the registry, which I'm passing along here.)

Related Topic