SOC Event Lookup
Event ID 4612SystemP3

Windows Event ID 4612: Internal audit queue resources exhausted

Windows Security Event ID 4612 records that audit queues were exhausted and some audit events were discarded.

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-13

Trigger Scenarios

The event is generated when security events are produced faster than they can be written to disk, or when the auditing system loses connectivity to event logging.

Key Fields

Number of audit messages discarded

The count of Security audit records lost. Any value greater than 0 means the log stream has a confirmed visibility gap.

Computer

The host where audit loss occurred. Loss on a domain controller or high-value server creates more investigative risk than a kiosk or test workstation.

TimeCreated

The start of the visibility gap. Use the timestamp to bound follow-up review in surrounding EDR, Sysmon, and infrastructure logs.

Common False Positives

  • Resource exhaustion, disk latency, RAM pressure, and event-log service issues can cause audit loss without adversary activity.
  • Large administrative changes can temporarily generate security events faster than the host can write them.

Related Events

MITRE ATT&CK Mapping

  • T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Detection Notes

Alert at threshold=1 for 4612 because the event schema reports discarded audit messages and Microsoft states that events must be discarded when the audit queue is filled. In a T1685.001 investigation, the count greater than 0 is the concrete evidence of lost Windows Event Log coverage; correlate the same host and time range with 4719 audit-policy changes, 1102 log clears, 4621 CrashOnAuditFail recovery, and EDR telemetry to reconstruct activity missing from Security logs.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4612
| project TimeGenerated, Computer, EventData
Splunk SPL
index=wineventlog EventCode=4612
| table _time, host, Message
Sample Log
Internal resources allocated for the queuing of audit messages have been exhausted.
Number of audit messages discarded: 37
Computer: FS01

Source

Official documentationMachine-readable JSON