SSCP · Question #1161
What happens if this registry value is set to 1? HKLM\System\CurrentControlSet\Control\Lsa\CrashonAuditFail
The correct answer is D. System will perform a shutdown if maximum log size is reached. Setting the CrashOnAuditFail registry value to 1 forces a system shutdown if security auditing fails to log an event due to full audit logs.
Question
What happens if this registry value is set to 1? HKLM\System\CurrentControlSet\Control\Lsa\CrashonAuditFail
Options
- ASystem will crash
- BSystem will continue operations as normal
- CNo such registry key exists
- DSystem will perform a shutdown if maximum log size is reached
- ESystem will overwrite logs
How the community answered
(31 responses)- A6% (2)
- D90% (28)
- E3% (1)
Why each option
Setting the `CrashOnAuditFail` registry value to 1 forces a system shutdown if security auditing fails to log an event due to full audit logs.
The system crashes specifically due to a full security log when configured not to overwrite, not just any audit failure.
The system will not continue normally if the security log is full and this setting is enabled.
This registry key does exist and serves a specific security function in Windows.
When `CrashOnAuditFail` is set to 1, the Windows operating system will intentionally halt (crash or shut down) if it cannot write an event to the security log because the log has reached its maximum size and is configured not to overwrite older events, ensuring no unrecorded auditable events occur.
This setting prevents overwriting logs; it triggers a shutdown instead of overwriting.
Concept tested: Windows security auditing; CrashOnAuditFail registry setting
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-policy-settings#crashonauditfail
Topics
Community Discussion
No community discussion yet for this question.