[FIX] Audit Events Have Been Dropped By The Transport

Some Windows users have discovered a lot of consecutive ‘Audit Events Have Been Dropped By The Transport.0’ event errors via Event Viewer. Most affected users are reporting that new instances of this error appear as the system is running. This issue is confirmed to occur on Windows 7, Windows 8.1, and Windows 10.

After investigating this particular issue thoroughly, it turns out that there are several instances that will cause this error code. Here’s a list of confirmed culprits that might lead to the apparition of this event error:

Now that you know every potential culprit, here’s a list of confirmed methods that other affected users have successfully used to prevent new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error from appearing:

Method 1: Resetting every Windows Update Component

Since this problem is often associated with a partially corrupted component of Windows Update, you should take the time to reset every important Windows Update component. In most cases, constant new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error are produced due to the fact that one or more WU (Windows Update) components are currently stuck in a limbo state.

If this scenario is applicable to you, you should be able to fix the problem by resetting every WU component involved in the updating process. When it comes to doing this, you have 2 ways forward:

A. Using the WU Reset Agent

1. Open your default browser and visit the download page for the Reset Windows Update Agent script.

   

2. Once the download is successfully downloaded, use a utility like WinRar, WinZip, or 7Zip to extract the contents of the archive.
3. Next, right-click on the ResetWUENG.exe file and choose Run as Administrator. When prompted by the UAC (User Account Control), click Yes to grant admin access.
4. Follow the on-screen instructions to run the script on your computer to reset every essential WU component.
5. Once the operation is finally complete, restart your computer and open the Event Viewer app once the next startup is complete to see if the error has been resolved.

B. Resetting the WU Component from an Elevated CMD

1. Open up a Run dialog box by pressing Windows key + R. Next, type ‘cmd’ inside the text box, then press Ctrl + Shift + Enter to open up an elevated Command Prompt.

   

   Note: When prompted by the UAC (User Account Prompt), click Yes to grant admin access.

2. Once you’re finally inside the elevated Command Prompt, type the following commands in whichever order but make sure to press Enter after each one to stop all WU related services:

   net stop wuauserv
   net stop cryptSvc
   net stop bits
   net stop msiserver

   Note: These commands will effectively stop the Windows Update services, the MSI installer, the Cryptographic services, and the BITS services.

3. After every service that might potentially interfere has been stopped, paste the following commands inside the CMD box and rename the SoftwareDistribution and Catroot2 folders:

   ren C:\Windows\SoftwareDistribution SoftwareDistribution.old 
   ren C:\Windows\System32\catroot2 Catroot2.old

   Note: These 2 folders are responsible for holding updated files that are in the process of being used by the Windows Update component. Since there is no means of deleting them conventionally, the next best thing is to rename them – This will force your OS to disregard it.

4. Once you have successfully renamed the 2 folders, run the following commands once again to re-enable the services that were disabled at step 2:

   net start wuauserv
   net start cryptSvc
   net start bits
   net start msiserver

5. Once every service is successfully re-enabled, open the Event Viewer utility and check to see if you spot any new instances of the error.

If the same ‘Audit Events Have Been Dropped By The Transport.0’ event errors are still popping up all over the place even after following one of the guides above, move down to the next potential fix below.

Method 2: Reinstalling the Network Driver

According to several affected users, this issue is sometimes associated with a conflict or a miss installation of the network adapter driver. In some cases, affected users have managed to fix this problem by using Device Manager to reinstall or update the faulty network adapter driver.

If you haven’t tried this yet and you’re still encountering the same constant  ‘Audit Events Have Been Dropped By The Transport.0’ event errors, follow the instructions below to effectively uninstall or update your current network adapter driver:

1. Open up a Run dialog box by pressing Windows key + R. Next, type ‘devmgmt.msc’ and press Enter to open up Device Manager. If you’re prompted by the UAC (User Account Control), click Yes to grant admin access.

   

2. Once you’re inside Device Manager, scroll all the way down to the Network adapters category and expand the drop-down menu. Next, right-click on your wireless network adapter and click on Update Driver.
   

   

3.  At the next prompt, click on Search Automatically for updated driver software and wait patiently to see if the scan reveals a new version of the network adapter.

   

   Note: If the wizard manages to find and install a new version of the network adapter, follow the on-screen prompts to install it and reboot your computer at the end of this process. If you already have the latest version installed, continue with the steps below.

4. Return to the Network adapters drop-down menu inside Device Manager, right-click on the Wireless Network Adapter, and click on Uninstall Device from the context menu that just appeared.

   

5. Confirm the uninstallation at the next prompt, then restart your computer in order to allow your OS to replace the recently uninstalled network adapter driver with a generic equivalent.
6. Check Event Viewer and see if you manage to spot any new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error.

If the same problem is still occurring or you manage to fix the issue and you’re looking to clear your error-filled Event Viewer log, move down to the next method.

Method 3: Deleting the Current Event Viewer Log

If one of the methods above has allowed you to stop the apparition of new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ event errors and you’re just looking to clear the log of Event Viewer, you can do so directly from the Options menu.

Update: It turns out that this operation might serve as a fix by itself since this error can also be triggered if there are too many requests that are being logged into the Security log. In most cases, you’ll end up seeing the ‘Audit Events Have Been Dropped By The Transport.0’ event error because your computer cannot handle the number of requests.

Follow the instructions below to delete the current Event Viewer Log from the Options menu:

1. Press Windows key + R to open up a Run dialog box. Next, type ‘eventvwr.msc‘ inside the text box and press Enter to open up the Event Viewer.

   

2. Once you’re inside Event Viewer, use the ribbon at the top to click on FIle. Then, from the context menu that just appeared, click on Options.
   

   

3. Inside the Options menu, click on Delete Files (under Disk Cleanup) and confirm when asked at the prompt by clicking Yes.

   

4. Restart your computer and see if the apparition of new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ event errors have stopped.