The 'Audit: Shut down system immediately if unable to log security audits' setting should be configured correctly. [Enabled/Disabled] (1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security audits oval:org.secpod.oval:def:14756 SCAP Repo OVAL Definition 2013-08-13