Windows Event ID 5141 – Microsoft-Windows-Security-Auditing: Object Access Auditing Failure

Start by examining the Security Event Log configuration and current status to identify immediate issues.

1. Open Event Viewer → Windows Logs → Security
2. Right-click Security log and select Properties
3. Check the Maximum log size and When maximum event log size is reached settings
4. If set to Do not overwrite events, change to Overwrite events as needed or increase log size
5. Use PowerShell to check current log status:

   Get-WinEvent -ListLog Security | Select-Object LogName, FileSize, MaximumSizeInBytes, RecordCount, IsEnabled

6. Check for recent 5141 events and their frequency:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5141} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

7. Review Event Log service status:

   Get-Service -Name EventLog | Select-Object Name, Status, StartType

Review current audit policies to identify overly aggressive settings that may be overwhelming the system.

1. Check current audit policy configuration:

   auditpol /get /category:*

2. Focus on Object Access auditing specifically:

   auditpol /get /subcategory:"File System" /subcategory:"Registry" /subcategory:"Handle Manipulation"

3. Open Local Security Policy or Group Policy Management Console
4. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
5. Review Object Access subcategories and disable unnecessary auditing:
   • Consider disabling Success auditing for high-traffic locations
   • Focus on Failure auditing for security monitoring
   • Disable auditing on system directories like C:\Windows\Temp
6. Check for SACL configurations on high-traffic directories:

   Get-Acl "C:\" -Audit | Select-Object -ExpandProperty Audit

7. Apply changes and monitor for improvement in 5141 frequency

Investigate system resource constraints that may be preventing proper audit event processing.

1. Check LSASS process resource usage:

   Get-Process lsass | Select-Object Name, CPU, WorkingSet, PagedMemorySize, HandleCount

2. Monitor Event Log service performance:

   Get-Counter "\Process(EventLog)\% Processor Time", "\Process(EventLog)\Working Set"

3. Check disk I/O performance on the system drive:

   Get-Counter "\PhysicalDisk(_Total)\Avg. Disk Queue Length", "\PhysicalDisk(_Total)\% Disk Time"

4. Review system memory usage:

   Get-Counter "\Memory\Available MBytes", "\Memory\Committed Bytes"

5. Open Performance Monitor and create a custom data collector set to track:
   • Process(lsass)\% Processor Time
   • Process(EventLog)\% Processor Time
   • LogicalDisk(C:)\% Free Space
   • System\Processor Queue Length
6. Run the data collector during peak hours when 5141 events occur
7. If resource constraints are identified, consider:
   • Adding more RAM to the system
   • Moving event logs to a faster disk
   • Reducing other system load during peak audit periods

Implement advanced event log management to handle high-volume audit environments more effectively.

1. Increase Security Event Log maximum size:

   wevtutil sl Security /ms:1073741824

2. Configure event log forwarding to reduce local storage pressure:

   # Enable WinRM for event forwarding
   winrm quickconfig -q
   # Configure subscription on collector server
   wecutil cs subscription.xml

3. Create a custom event log for high-volume audit events:

   New-WinEvent -ProviderName "Microsoft-Windows-Security-Auditing" -Id 5141 -Version 1

4. Configure audit policy to use custom channels through registry:
   • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security
   • Modify MaxSize value to increase log capacity
   • Set Retention to 0 for overwrite as needed
5. Implement PowerShell-based log rotation:

   # Archive and clear Security log when it reaches 80% capacity
   $log = Get-WinEvent -ListLog Security
   if (($log.FileSize / $log.MaximumSizeInBytes) -gt 0.8) {
       wevtutil epl Security "C:\Logs\Security_$(Get-Date -Format 'yyyyMMdd_HHmmss').evtx"
       wevtutil cl Security
   }

6. Schedule the rotation script as a Windows Task to run every hour during peak periods

Perform deep system analysis and recovery procedures for persistent 5141 issues.

1. Check for audit subsystem corruption:

   # Verify security database integrity
   sfc /scannow
   Dism /Online /Cleanup-Image /CheckHealth

2. Reset audit policy to defaults and reconfigure:

   # Backup current policy
   auditpol /backup /file:C:\temp\audit_backup.csv
   # Reset to defaults
   auditpol /clear /y
   # Restore minimal required auditing
   auditpol /set /subcategory:"Logon" /success:enable /failure:enable

3. Rebuild Event Log service configuration:

   # Stop Event Log service
   Stop-Service EventLog -Force
   # Clear event log registry corruption
   Remove-Item "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\*" -Recurse -Force
   # Restart service to rebuild
   Start-Service EventLog

4. Check for third-party software conflicts:
   • Temporarily disable antivirus real-time scanning
   • Stop non-essential services that may interfere with auditing
   • Review recently installed software that might hook into security subsystem
5. Enable debug logging for audit subsystem:

   # Enable LSA debug logging
   reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaDbgInfoLevel /t REG_DWORD /d 0x800 /f
   # Restart system to apply changes

6. If issues persist, consider:
   • Running Windows Memory Diagnostic to check for hardware issues
   • Performing in-place Windows upgrade to repair system files
   • Consulting Microsoft Support with debug logs and system configuration