Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors.

I did some troubleshooting around the internet and found out that I should stop auditing a lot of this stuff. I tried creating a batchfile with a few commands like below:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable

There are several other lines, but that was the first.

On the 1st DC I tried that line on, the command prompt started a very rapid infinite loop just entering that command over and over. Ctrl-C brings up "terminate batch job (Y/N)?" after a few minutes allowing me to stop the loop.

Now, when I try running ANY 'auditpol' command no matter what it is (for example: auditpol /get /category:* or auditpol /? ), it repeats the set command listed ABOVE in an infinite loop again.

I've rebooted the server 3 times, and the command still seems to be locked in somewhere and always comes back no matter what I've tried. I haven't touched the other DCs yet, because I don't want to cause problems on them until this one is straightened out.

Any assistance will be appreciated.

share|improve this question

Did you create a batch file and name it "auditpol.cmd"? If so, then that is most likely the problem, since the script will just keep calling itself recursively. I can't see any other reason as to why what you are describing would be happening.

What happens if you bring up task manager and terminate the auditpol.exe command?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.