Hi All,

We are facing a weird issue in our Domain Controllers. We face issue that suddenly the Domain Controller Security log fills with event ID 521. In this case we have to reboot the DC and then it works fine for few days.

We have tried the below mentioned steps:

• Checked the permission on C:\Windows\System32\Winevt\Logs folder and provide full control to network service and local service also.
• Checked the permission on C:\Windows\System32\logfiles\WMI\rtbackup and provided required permission
• Renamed the security.evtx file but the problem reoccurs after few days
• Checked "AutoBackupLogFiles" key is already present

Unable to log events to security log:
    Status code:        0xc0000008
    Value of CrashOnAuditFail:  0
    Number of failed audits:    51

What else can be done

Hi

 Thats a process tried to open a file and failed.In this case the file was likely the "security.evtx" security even log file.First creating a new ".evtx" file and checking the overwrite event log settings.Make sure you have enough hard dirve space that there is actually room to write to the file.

also install Microssoft Network Monitor on DC and analyse the traffic,etc...

Download Microsoft network monitr;

http://www.microsoft.com/en-us/download/details.aspx?id=4865

Have a look on the below:

http://serverfault.com/questions/597859/windows-2008-r2-server-security-log-filling-with-event-521

I have similar issue with DC running on Windows Server 2008. A reboot did solve the issue but it was temporary. After that the error keeps coming up until next reboot. Is there anyway to permanently resolve the issue as server reboot doesn't cut it? The frustrating part is this error is affecting most of my DC and I cannot troubleshoot any account lockout issue because of it. Any advise would be appreciated.