[FIX] Audit Events Have Been Dropped By The Transport

Some Windows users have discovered a lot of consecutive ‘Audit Events Have Been Dropped By The Transport.0’ event errors via Event Viewer. Most affected users are reporting that new instances of this error appear as the system is running. This issue is confirmed to occur on Windows 7, Windows 8.1, and Windows 10.

Audit Events have been Dropped by the Transport.0

After investigating this particular issue thoroughly, it turns out that there are several instances that will cause this error code. Here’s a list of confirmed culprits that might lead to the apparition of this event error:

  • Corrupted WU Component – In the vast majority of cases, this issue is associated with a partially corrupted component of Windows Update. If this scenario is applicable, the only viable fix is to reset every involved sub-component either by the automated WU reset agent or by doing it manually from an elevated Command Prompt.
  • Improper / Incompatible WU Reset driver – With certain configurations, Windows 10 users have reported that they’ve confirmed that the Event Viewer logs have stopped after they’ve used Device Manager to reinstall or update the network adapter that was previously in use.
  • Too many Requests into the Security log – As it turns out, you can expect to see this error in instances where there are too many requests that are being logged into the Security Log at the same time. This might happen due to a bug on Windows 10. If this is applicable, you can fix the issue by deleting the entire Event Viewer log.

Now that you know every potential culprit, here’s a list of confirmed methods that other affected users have successfully used to prevent new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error from appearing:

Method 1: Resetting every Windows Update Component

Since this problem is often associated with a partially corrupted component of Windows Update, you should take the time to reset every important Windows Update component. In most cases, constant new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error are produced due to the fact that one or more WU (Windows Update) components are currently stuck in a limbo state.

If this scenario is applicable to you, you should be able to fix the problem by resetting every WU component involved in the updating process. When it comes to doing this, you have 2 ways forward:

A. Using the WU Reset Agent

  1. Open your default browser and visit the download page for the Reset Windows Update Agent script.
    Downloading the Windows Update Agent script
  2. Once the download is successfully downloaded, use a utility like WinRar, WinZip, or 7Zip to extract the contents of the archive.
  3. Next, right-click on the ResetWUENG.exe file and choose Run as Administrator. When prompted by the UAC (User Account Control), click Yes to grant admin access.
  4. Follow the on-screen instructions to run the script on your computer to reset every essential WU component.
  5. Once the operation is finally complete, restart your computer and open the Event Viewer app once the next startup is complete to see if the error has been resolved.

B. Resetting the WU Component from an Elevated CMD

  1. Open up a Run dialog box by pressing Windows key + R. Next, type ‘cmd’ inside the text box, then press Ctrl + Shift + Enter to open up an elevated Command Prompt.
    Opening an elevated Command Prompt

    Note: When prompted by the UAC (User Account Prompt), click Yes to grant admin access.

  2. Once you’re finally inside the elevated Command Prompt, type the following commands in whichever order but make sure to press Enter after each one to stop all WU related services:
    net stop wuauserv
    net stop cryptSvc
    net stop bits
    net stop msiserver

    Note: These commands will effectively stop the Windows Update services, the MSI installer, the Cryptographic services, and the BITS services.

  3. After every service that might potentially interfere has been stopped, paste the following commands inside the CMD box and rename the SoftwareDistribution and Catroot2 folders:
    ren C:\Windows\SoftwareDistribution SoftwareDistribution.old 
    ren C:\Windows\System32\catroot2 Catroot2.old

    Note: These 2 folders are responsible for holding updated files that are in the process of being used by the Windows Update component. Since there is no means of deleting them conventionally, the next best thing is to rename them – This will force your OS to disregard it.

  4. Once you have successfully renamed the 2 folders, run the following commands once again to re-enable the services that were disabled at step 2:
    net start wuauserv
    net start cryptSvc
    net start bits
    net start msiserver
  5. Once every service is successfully re-enabled, open the Event Viewer utility and check to see if you spot any new instances of the error.

If the same ‘Audit Events Have Been Dropped By The Transport.0’ event errors are still popping up all over the place even after following one of the guides above, move down to the next potential fix below.

Method 2: Reinstalling the Network Driver

According to several affected users, this issue is sometimes associated with a conflict or a miss installation of the network adapter driver. In some cases, affected users have managed to fix this problem by using Device Manager to reinstall or update the faulty network adapter driver.

If you haven’t tried this yet and you’re still encountering the same constant  ‘Audit Events Have Been Dropped By The Transport.0’ event errors, follow the instructions below to effectively uninstall or update your current network adapter driver:

  1. Open up a Run dialog box by pressing Windows key + R. Next, type ‘devmgmt.msc’ and press Enter to open up Device Manager. If you’re prompted by the UAC (User Account Control), click Yes to grant admin access.
    Opening Device Manager
  2. Once you’re inside Device Manager, scroll all the way down to the Network adapters category and expand the drop-down menu. Next, right-click on your wireless network adapter and click on Update Driver.

    Updating Network Adapter
  3.  At the next prompt, click on Search Automatically for updated driver software and wait patiently to see if the scan reveals a new version of the network adapter.
    Searching for the updated driver software for your network adapter

    Note: If the wizard manages to find and install a new version of the network adapter, follow the on-screen prompts to install it and reboot your computer at the end of this process. If you already have the latest version installed, continue with the steps below.

  4. Return to the Network adapters drop-down menu inside Device Manager, right-click on the Wireless Network Adapter, and click on Uninstall Device from the context menu that just appeared.
    Uninstalling the current Network Adapter
  5. Confirm the uninstallation at the next prompt, then restart your computer in order to allow your OS to replace the recently uninstalled network adapter driver with a generic equivalent.
  6. Check Event Viewer and see if you manage to spot any new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ error.

If the same problem is still occurring or you manage to fix the issue and you’re looking to clear your error-filled Event Viewer log, move down to the next method.

Method 3: Deleting the Current Event Viewer Log

If one of the methods above has allowed you to stop the apparition of new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ event errors and you’re just looking to clear the log of Event Viewer, you can do so directly from the Options menu.

Update: It turns out that this operation might serve as a fix by itself since this error can also be triggered if there are too many requests that are being logged into the Security log. In most cases, you’ll end up seeing the ‘Audit Events Have Been Dropped By The Transport.0’ event error because your computer cannot handle the number of requests.

Follow the instructions below to delete the current Event Viewer Log from the Options menu:

  1. Press Windows key + R to open up a Run dialog box. Next, type ‘eventvwr.msc‘ inside the text box and press Enter to open up the Event Viewer.
    Opening the Event Viewer via Run dialog box
  2. Once you’re inside Event Viewer, use the ribbon at the top to click on FIle. Then, from the context menu that just appeared, click on Options.

    Accessing the Options menu of Event Viewer
  3. Inside the Options menu, click on Delete Files (under Disk Cleanup) and confirm when asked at the prompt by clicking Yes.
    Deleting the entire Event Viewer Log
  4. Restart your computer and see if the apparition of new instances of the ‘Audit Events Have Been Dropped By The Transport.0’ event errors have stopped.
Kevin Arrows
Kevin is a dynamic and self-motivated information technology professional, with a Thorough knowledge of all facets pertaining to network infrastructure design, implementation and administration. Superior record of delivering simultaneous large-scale mission critical projects on time and under budget.

Expert Tip

[FIX] Audit Events Have Been Dropped By The Transport

If the issue is with your Computer or a Laptop you should try using Restoro which can scan the repositories and replace corrupt and missing files. This works in most cases, where the issue is originated due to a system corruption. You can download Restoro by clicking the Download button below.

Download Now

I'm not interested