Error Access Audit by Policy 785 (0x311): How to Fix it

ERROR_ACCESS_AUDIT_BY_POLICY usually affects system administrators, and it will prevent you from accessing certain components. However, here’s what you can do to fix this.

How can I fix ERROR_ACCESS_AUDIT_BY_POLICY?

1. Identify the blocked resource

1. Press the Windows key + X and choose Event Viewer.
   
2. Next, go to Windows Logs and choose Security.
3. Look for events 4656, 4663, or 5145.
4. Check the Policy Rule ID and blocked the resource path.

2. Check your Group Policy settings

1. Press Windows key + R and type gpedit.msc.
   
2. Now navigate to the following path Computer Configuration and select Windows Settings.
3. Select Security Settings and then Advanced Audit Policy Configuration. Lastly, go to System Audit Policies.
   
4. Now look for any audit policy settings related to File System, Object Access, or Application Control.
5. If the policy is blocking access, double-click on it, disable or modify enforcement rules and save changes.

3. Check Windows Defender Application Control

1. Press Windows key + S and type powershell. Choose Run as administrator.
   
2. Next, run Get-CIPolicy | Select-String "Policy"
   
3. If the policy is restricting access, disable it with the following command: Set-RuleOption -Option 3 -Disabled
    

4. Adjust folder permissions

1. Right-click the blocked file or folder and choose Properties.
   
2. Next, go to the Security tab and choose Advanced.
   
3. Ensure that your user has the necessary permissions.
4. If it doesn’t adjust them accordingly.

5. Disable auditing for the resource

1. Open Command Prompt as administrator.
2. Next, run the following command: auditpol /set /subcategory:"File System" /success:disable /failure:disable
   
3. Be sure to replace “File System” with the correct category from Event Viewer.

You can often recognize ERROR_ACCESS_AUDIT_BY_POLICY by the following error message: 785 (0x311) Access to %1 is monitored by policy rule %2.

In most cases, identifying the blocked resource and adjusting your settings should help with this error.

We have covered similar issues in the past, and to learn more visit our AGP_INVALID_ACCESS and ERROR_DIRECT_ACCESS_HANDLE articles.