# CVE-1999-0575: Microsoft Windows NT missing security audit logging policy

Source: https://junglewise.ai/threats/cve-1999-0575-microsoft-windows-nt-missing-security-audit-logging-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-01-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0575 · Severity: high · CVSS 7.5 · Published 1997-01-01

A configuration issue in Windows NT systems allows the operating system to operate without logging critical security events. This means that unauthorized activities, such as failed login attempts, file access, or system shutdowns, are not recorded in the audit logs. In the event of a security breach, administrators would have no forensic trail to identify how the system was compromised or what data was accessed.

Technologies: [Microsoft Windows Nt](https://junglewise.ai/threats/technologies/windows-nt). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-1999-0575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0575 being exploited in the wild.

**How severe is CVE-1999-0575?** High severity, with a CVSS score of 7.5, published 1 January 1997.

**Which products and versions are affected?** Microsoft Windows NT NT 4.0 and earlier.

**Is there a fix for CVE-1999-0575?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0575 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-0575?** Check whether you run Microsoft Windows Nt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability stems from a failure to enable or enforce a comprehensive user audit policy within Windows NT. The system fails to generate log entries for success or failure events across multiple categories: Logon and Logoff, File and Object Access, Use of User Rights, User and Group Management, Security Policy Changes, Restart, Shutdown, and Process Tracking. This lack of visibility allows attackers to perform reconnaissance, lateral movement, and administrative changes without leaving a trace in the local security event logs. While primarily a configuration-based weakness, it is classified as a high-severity issue due to the complete loss of accountability and forensic capability on the affected host.

## Affected products

- Microsoft Windows NT NT 4.0 and earlier

## Timeline

- 1997-01-01: disclosed: NVD Published Date

## References

- [https://www.cve.org/CVERecord?id=CVE-1999-0575](https://www.cve.org/CVERecord?id=CVE-1999-0575)

## Related threats

- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42980-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42916-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT denial of service in SMB logon request](https://junglewise.ai/threats/cve-1999-0225-microsoft-windows-nt-denial-of-service-in-smb-logon-request)
- [Microsoft Windows TCP/IP stack denial of service in IP fragmentation](https://junglewise.ai/threats/cve-1999-0258-microsoft-windows-tcp-ip-stack-denial-of-service-in-ip)
- [War FTP buffer overflow allows remote command execution](https://junglewise.ai/threats/cve-1999-0256-war-ftp-buffer-overflow-allows-remote-command-execution)