The 'Audit: Shut down system immediately if unable to log security audits' setting should be configured correctly.
[Enabled/Disabled]
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security audits
oval:org.secpod.oval:def:14756
SCAP Repo OVAL Definition
2013-08-13