WWindows RepairIntelligence™
Search
ToolsFavoritesHistoryLogin
Windows Repair Intelligence™ Report

0X80070311

Access to %1 is monitored by policy rule %2

Home / Error Codes / Security and permissions / 0X80070311

Microsoft defines 0X80070311 as ERROR_ACCESS_AUDIT_BY_POLICY: Access to %1 is monitored by policy rule %2.

SeverityMediumSystemsWindows 10 / 11SymbolERROR_ACCESS_AUDIT_BY_POLICYUpdatedSep 1, 2026

Overview

0X80070311 wraps Win32 result 785 (0x311) through FACILITY_WIN32 (7). The code identifies the failure condition, while the calling program, timestamp, logs, and repeatable operation identify the responsible component.

Common causes

  • The affected operation returned the official ERROR_ACCESS_AUDIT_BY_POLICY condition
  • The calling program encountered the documented result: Access to %1 is monitored by policy rule %2.
  • A configuration, resource, or dependency used by the security and permissions operation did not meet its requirements
  • A recent program, service, installer, or system change altered the context in which 0X80070311 occurs

Symptoms

  • Confirm which program or Windows operation returned 0x80070311
  • Match the timestamp to Application and System event records
  • Retest the same operation and preserve any changed result code

Prevention

  • Preserve Application and System events that accompany 0X80070311
  • Use supported installers and configuration methods for the affected security and permissions workflow
  • Document changes so the operating context for ERROR_ACCESS_AUDIT_BY_POLICY can be reconstructed

0X80070311 diagnostic evidence

Official-definition grounded

Use the code identity and the affected operation together. The same numeric result can appear in different workflows, so logs and symptoms determine the safest repair branch.

Hexadecimal0X80070311
Unsigned decimal2147943185
SymbolERROR_ACCESS_AUDIT_BY_POLICY
Error familySecurity and permissions
Severity bitFailure
Evidence sourceMicrosoft System Error Codes (WinError.h)
1Confirm the operationConfirm which program or Windows operation returned 0x80070311
2Collect matching evidenceMatch the timestamp to Application and System event records
3Retest the same actionRetest the same operation and preserve any changed result code

Definition source: Microsoft System Error Codes (WinError.h). This report preserves the official code identity and does not claim one universal cause.

How to troubleshoot error 0X80070311

Use these Windows-native steps in order. Stop when Windows Update works again; advanced repair commands are not necessary on every PC.

1

Restart Windows and retry the update

Save your work, restart the PC, then open Settings > Windows Update and select Check for updates. A restart can release pending files without changing Windows configuration.

2

Run the Windows Update troubleshooter

Open Settings > System > Troubleshoot > Other troubleshooters. Locate Windows Update and select Run. Current Windows 11 versions may continue the diagnostic flow in Get Help.

3

Repair Windows components when indicated

If troubleshooting still reports missing or damaged components, open Terminal as administrator, run DISM RestoreHealth, and then run System File Checker. Do not interrupt either scan.

Before advanced repair: Back up important files. Managed work or school PCs may use organization update policies, so contact the administrator before changing services or update components.

Official-source grounding

The error meaning is grounded in Microsoft System Error Codes (WinError.h). The visual sequence also follows Microsoft Support guidance for Windows Update troubleshooting and Microsoft DISM repair guidance. Causes and repair steps vary by system evidence; this report does not claim a universal success rate.

Frequently asked questions

What does 0X80070311 mean?

Microsoft defines 0X80070311 as ERROR_ACCESS_AUDIT_BY_POLICY: Access to %1 is monitored by policy rule %2. 0X80070311 wraps Win32 result 785 (0x311) through FACILITY_WIN32 (7). The code identifies the failure condition, while the calling program, timestamp, logs, and repeatable operation identify the responsible component.

Is 0X80070311 always caused by the same problem?

No. The code identifies a failure condition, but the exact cause depends on the affected operation, Windows build, logs, and recent system changes.

Can Advanced System Repair help with 0X80070311?

Advanced System Repair can scan for damaged Windows components and related system issues. No tool can guarantee one universal fix; preserve backups and match repair steps to the evidence on the affected PC.