How to troubleshoot 521 Events in Windows Security Log

[Kel Koop]

I am getting a slew of Event 521 in the WIndows Security Log on about half my DCs. they are triggering Critical Alerts in ADAudit, so I need to determine the cause and resolve it. So far, I have Rebooted the DCConfirmed adequate disk spaceConfirmed permissions on the .evtx fileCleared the Security LogDeleted and re-create the Security .evtx fileSet Log size to 1GBEnabled AutoArchive of the LogsSet Security Log BufferSize=256 and MaxBuffers=64 Any suggestions on how to troubleshoot this and find the cause would be roundly appreciated

Continue reading...