See if this applies. (Taken from http://www.wilderssecurity.com/showthread.php?t=246876)
This issue is typically caused by an invalid registry value in the Restore subkey for the DFSR service. Look at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfsr\Restore. There will be a sub key named year-date-time the restore was done with two values. One of those values will be the network name that was used to perform the remote restore. - Backup and delete the restore subkey - Restart DFSR (if it won't stop, restart machine). - After the reg value is removed the service start and stop will be normal On 4/9/10, Ben Scott <mailvor...@gmail.com> wrote: > Hey all, > > On one of our Vista machines, I saw the below repeated several times > in a row in the Security log. > > ID: 1108 > Source: Eventlog > Message: The event logging service encountered an error while > processing an incoming event published from > Microsoft-Windows-Security-Auditing. > > Happened during a computer startup earlier this week, according to > the log. Just that one time. No other know trouble. Seemed to run > okay today. Software load is Vista SP2, Office 2007 SP2, Symantec > Endpoint Protection 11.0 MR4 MP2, and DeviceLock 6.4. That's about > it. Stand-alone system, no networking. > > Anyone have any idea what this actually means and how to > trouble-shoot? I just know the inspector is going to be crawling up > my butt on it when review time comes around. I can't exactly tell him > "Windows just drops security events occasionally"... > > Google found a symbolic name, EVENT_AUDIT_PROCESSING, and some > random people complaining, but nothing really helpful. > > -- Ben > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
