SOC Event Lookup
Event ID 4612SystemP3

Windows Event ID 4612: Internal audit queue resources exhausted

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4612 records that audit queues were exhausted and some audit events were discarded.

Technical Metadata

Technical metadata for Event ID 4612
Event ID4612
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log
Key fields to watchNumber of audit messages discarded, Computer, TimeCreated

Trigger Scenarios

The event is generated when security events are produced faster than they can be written to disk, or when the auditing system loses connectivity to event logging.

Key Fields

Number of audit messages discarded

The count of Security audit records lost. Any value greater than 0 means the log stream has a confirmed visibility gap.

Computer

The host where audit loss occurred. Loss on a domain controller or high-value server creates more investigative risk than a kiosk or test workstation.

TimeCreated

The start of the visibility gap. Use the timestamp to bound follow-up review in surrounding EDR, Sysmon, and infrastructure logs.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4612
SecurityEvent
| where EventID == 4612
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4612
index=wineventlog source="WinEventLog:Security" EventCode=4612
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4612
dataset = microsoft_windows_raw
| filter edr_event_id = 4612
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4612
title: Windows Security Event ID 4612
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4612
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID4612The internal audit queue was exhausted and audit messages were discarded.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source
DiscardedCount>0A positive discarded-message count establishes loss of audit records.Interpret DiscardedCount with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Detection Notes

Alert at threshold=1 for 4612 because the event schema reports discarded audit messages and Microsoft states that events must be discarded when the audit queue is filled. In a T1685.001 investigation, the count greater than 0 is the concrete evidence of lost Windows Event Log coverage; correlate the same host and time range with 4719 audit-policy changes, 1102 log clears, 4621 CrashOnAuditFail recovery, and EDR telemetry to reconstruct activity missing from Security logs.

Common False Positives

  • Resource exhaustion, disk latency, RAM pressure, and event-log service issues can cause audit loss without adversary activity.
  • Large administrative changes can temporarily generate security events faster than the host can write them.

Related Events

Sample Log

Sanitized event sample
Internal resources allocated for the queuing of audit messages have been exhausted.
Number of audit messages discarded: 37
Computer: FS01

Frequently Asked Questions

What does Windows Event ID 4612 mean?

Windows discarded security audit messages because internal audit queue resources were exhausted.

Does Event ID 4612 always indicate malicious activity?

Resource pressure or logging failures can cause it without attacker action.

How should Event ID 4612 be investigated?

Record the discarded count and time span, check log and disk health, and reconstruct the gap from EDR and infrastructure telemetry.

Sources