How to fix Error 606 on Windows 11

by

Windows Event ID 606: “Audit Failed” Troubleshooting Guide

Why This Error Happens

Event ID 606 occurs when the Security Event Log’s audit policy fails to be generated or applied correctly, often due to insufficient permissions on the security subsystem or a corrupted audit policy configuration. This can also happen when the Security Event Log reaches its maximum size and cannot roll over properly, or when the Local Security Authority Subsystem Service (LSASS) encounters a conflict while attempting to write audit data. In some cases, third-party security software or Group Policy misconfigurations interfere with the Windows auditing subsystem.

Step-by-Step Resolution Guide

  1. Check Security Log Size and Retention Settings
  • Open Event Viewer (eventvwr.msc) → Navigate to Windows Logs > Security
  • Right-click Security → Properties
  • Increase the maximum log size (e.g., to 4GB) and set retention to “Overwrite events as needed”
  1. Reset the Audit Policy Using SecEdit
  • Open Command Prompt as Administrator
  • Run: auditpol /clear /y to reset all audit policies
  • Reconfigure required policies with: auditpol /set /category:"System","Logon/Logoff","Account Management" /success:enable /failure:enable
  1. Verify Permissions on the Security Log
  • Navigate to C:\Windows\System32\winevt\Logs
  • Right-click Security.evtx → Properties > Security
  • Ensure the SYSTEM, Administrators, and Event Log Readers groups have Full Control/Read permissions
  1. Run System File Checker and DISM
  • Open Command Prompt as Administrator
  • Run: sfc /scannow
  • Follow with: DISM /Online /Cleanup-Image /RestoreHealth
  • Restart the computer after completion
  1. Check Group Policy for Conflicting Audit Settings
  • Open gpedit.msc → Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration
  • Ensure no conflicting or duplicate policies are set between Local Policy and Domain Policy (if applicable)
  • Run gpupdate /force after making changes

Alternative or Verification Steps

  • Verify the fix: Open Event Viewer and check if new Security events (e.g., Event ID 4624, 4634) are being logged correctly without further 606 errors appearing.
  • Alternative solution: If the issue persists, temporarily disable third-party antivirus/security software to rule out interference, then re-run auditpol /get /category:* to confirm audit policies are applied system-wide.