Event ID 1108: How to Fix This Windows Security Error

Many users report the Windows security error appearing on their screen when using their computers. When the Event ID 1108: The event logging service encounters an error pops up, it can make your system unusable.

Likewise, others complain about a similar Event ID 1001 error in Windows 11.

What is Event ID 1108?

The Event ID 1108 indicates that the logging service encountered an error while processing an incoming event from the publisher. It comes from Microsoft Windows Security Auditing, showing that the logging service can’t correctly write the event log.

Furthermore, event ID 1108 comes after a defective or compromised event. So, when logging parameters are not passed correctly to the logging service, it won’t be able to log the event, resulting in an error.

Why do I encounter this error?

There are a few reasons why the event ID 1108 appears on your PC. The most common one is the Log service being disabled. When the service is disabled, it won’t be able to process any log or event, resulting in errors.

Other factors that may be responsible for the error are:

• Incorrect security settings in the log directory – The Log service may run into errors if the security settings configured in the log files are wrong. They can affect how it interacts with the events.
• Missing parameters in the logging service – When parameters essential for the logging service are missing, it won’t be able to process the incoming event. It may result in errors like event ID 1108 and event ID 41 on Windows 11.
• Too many log files – Running into these errors can sometimes mean that your device has too many log files that it can’t handle. So, it prompts the event error to tell you it’s stuck.

These causes may vary in different log instances, but you can fix them by troubleshooting your system.

How do I fix the Event ID 1108 Windows security error?

Before trying any advanced troubleshooting steps, proceed with the following:

• Create a Restore Point on your computer.
• Disconnect any remote connection.
• Turn off background apps on your PC.
• Restart Windows in Safe Mode and check if the event ID pops up.

If the error persists, try the solutions provided below.

1. Restart Windows Event Log Service

1. Press Windows + R key to open the Run dialog box, type services.msc, and press Enter.
2. Find the Windows Event Log service in the services list, right-click on it and select Restart from the drop-down.
3. Restart your PC and check if you can fix the Event ID 1108 error.

Restart Windows Event Log service will help refresh its log and clear off event logs that are not correctly logged, causing it to run into errors.

2. Modify the Registry Editor

1. Press Windows + R key to open the Run dialog box, type Regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
3. Right-click on Start on the right pane, then click on Modify from the drop-down.
4. Set the Value Data as 1 and click OK to save the changes.

Modifying the registry value can fix any problems with the EventLog that is causing the error. You may be interested in how to customize the Registry Editor on Windows 11.

3. Use a third-party tool

One method that could really work here is using a third-party repair tool that will scan and find any issues on your computer.

4. Run System Restore

1. Left-click the Start button, type restore, and click on Create a Restore Point.
2. Go to the System Protection tab, then click System Restore.
3. Select the Choose a different system restore option and click Next to choose a specific Restore Point.
4. Select the last time the system worked correctly, then click Next.
5. Click the Finish button.

A system restore will backdate your computer, removing the compromised items on it. If you can’t get around the above steps, check how to fix Restore Point if it’s not working on your PC.

5. Overwrite redundant Log files

1. Press Windows + X key to open the Quick Access Menu and click the Event Viewer.
2. Select Windows Logs from the drop-down, choose the System option, and click on Properties.
3. Navigate to the General tab and check the box for Overwrite events as needed (oldest events first).
4. Click OK, then Apply.

Overwriting the redundant Log files will clear any events not correctly logged that are causing issues with the system.

Alternatively, you can read how to fix the Event Viewer reboot event ID error in Windows 11. Also, we have a detailed guide on the best event log viewers.

If you have further questions or suggestions, do not hesitate to use the comments section.