Title

System halts once an event log has reached its maximum size. (Cat III impact)

Discussion

A system that is configured to halt if an event log becomes full can create a denial of service situation.

Check Content

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Audit: Shut down system immediately if unable to log security audits” to “Disabled”.

Additional Identifiers

Rule ID: SV-25033r1_rule

Vulnerability ID: V-1091

Group Title: Halt on Audit Failure

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.