Audit events have been dropped by the transport

// EVENT DEFINITION:

Audit events have been dropped by the real-time event log backup or transport pipeline.

// DETAILED TELEMETRY & CONTEXT:

Event ID 1101 is recorded when the security audit subsystem cannot write log entries fast enough or transport queues overflow, causing security events to be permanently dropped. This indicates serious high-volume log flooding or I/O bottleneck issues.

[ ! ]Failure Reason / Root Cause Analysis

Log storage disk saturation, extreme event flooding by an adversary or malfunctioning service, or slow SIEM agent ingestion.

Operational Metadata & Applicability

Log Category:Event Log

Audit Type Classification:Success Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

dropped eventstransport errorbuffer overflowlogging failureaudit dropped

MITRE ATT&CK Framework Alignment

T1562.002

Impair Defenses: Disable Windows Event LoggingTactic: Defense Evasion

Mitigation Playbook & Recommended SOC Actions

•Check storage queue limits and disk latency where the `Security.evtx` file resides.
•Investigate potential denial-of-service or brute-force activities generating excessive log throughput.

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>1101</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.237Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to Audit events have been dropped by the transport -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)