WWindows RepairIntelligence™
Search
ToolsFavoritesHistoryLogin
Windows Repair Intelligence™ Report

0X00000311

Access to %1 is monitored by policy rule %2

Home / Error Codes / Security and permissions / 0X00000311

Microsoft defines 0X00000311 as ERROR_ACCESS_AUDIT_BY_POLICY: Access to %1 is monitored by policy rule %2.

SeverityMediumSystemsWindows 10 / 11SymbolERROR_ACCESS_AUDIT_BY_POLICYUpdatedSep 1, 2026

Overview

0X00000311 is the Win32 representation of ERROR_ACCESS_AUDIT_BY_POLICY. The code identifies the documented condition, while the calling program, timestamp, logs, and repeatable operation identify the responsible component.

Common causes

  • The affected operation returned the official ERROR_ACCESS_AUDIT_BY_POLICY condition
  • The calling program encountered the documented result: Access to %1 is monitored by policy rule %2.
  • A configuration, resource, or dependency used by the security and permissions operation did not meet its requirements
  • A recent program, service, installer, or system change altered the context in which 0X00000311 occurs

Symptoms

  • Confirm which operation returned 0x00000311
  • Match 0x00000311 to events from the same timestamp
  • Retest once and preserve any changed result

Prevention

  • Preserve Application and System events that accompany 0X00000311
  • Use supported installers and configuration methods for the affected security and permissions workflow
  • Document changes so the operating context for ERROR_ACCESS_AUDIT_BY_POLICY can be reconstructed

0X00000311 diagnostic evidence

Official-definition grounded

Use the code identity and the affected operation together. The same numeric result can appear in different workflows, so logs and symptoms determine the safest repair branch.

Hexadecimal0X00000311
Unsigned decimal785
SymbolERROR_ACCESS_AUDIT_BY_POLICY
Error familySecurity and permissions
Severity bitSuccess / informational
Evidence sourceMicrosoft System Error Codes (WinError.h)
1Confirm the operationConfirm which operation returned 0x00000311
2Collect matching evidenceMatch 0x00000311 to events from the same timestamp
3Retest the same actionRetest once and preserve any changed result

Definition source: Microsoft System Error Codes (WinError.h). This report preserves the official code identity and does not claim one universal cause.

How to troubleshoot error 0X00000311

Use these Windows-native steps in order. Stop when Windows Update works again; advanced repair commands are not necessary on every PC.

1

Restart Windows and retry the update

Save your work, restart the PC, then open Settings > Windows Update and select Check for updates. A restart can release pending files without changing Windows configuration.

2

Run the Windows Update troubleshooter

Open Settings > System > Troubleshoot > Other troubleshooters. Locate Windows Update and select Run. Current Windows 11 versions may continue the diagnostic flow in Get Help.

3

Repair Windows components when indicated

If troubleshooting still reports missing or damaged components, open Terminal as administrator, run DISM RestoreHealth, and then run System File Checker. Do not interrupt either scan.

Before advanced repair: Back up important files. Managed work or school PCs may use organization update policies, so contact the administrator before changing services or update components.

Official-source grounding

The error meaning is grounded in Microsoft System Error Codes (WinError.h). The visual sequence also follows Microsoft Support guidance for Windows Update troubleshooting and Microsoft DISM repair guidance. Causes and repair steps vary by system evidence; this report does not claim a universal success rate.

Frequently asked questions

What does 0X00000311 mean?

Microsoft defines 0X00000311 as ERROR_ACCESS_AUDIT_BY_POLICY: Access to %1 is monitored by policy rule %2. 0X00000311 is the Win32 representation of ERROR_ACCESS_AUDIT_BY_POLICY. The code identifies the documented condition, while the calling program, timestamp, logs, and repeatable operation identify the responsible component.

Is 0X00000311 always caused by the same problem?

No. The code identifies a failure condition, but the exact cause depends on the affected operation, Windows build, logs, and recent system changes.

Can Advanced System Repair help with 0X00000311?

Advanced System Repair can scan for damaged Windows components and related system issues. No tool can guarantee one universal fix; preserve backups and match repair steps to the evidence on the affected PC.