Too Many 'Audit Success' Security-Auditing Events Happening

EdTittel · 10 Sep 2016

Ouch! Now I'm starting to understand more fully why this is making you miserable. I'll chew on this over dinner and get back to you later this evening with any thoughts I might come up with. In the meantime, you might want to grab the Sysinternals Process Explorer and watch it along with Resource Monitor (built into Windows) to see what's happening with your CPU as these hiccups are occurring. This might give some insight into where the resources are being consumed.
Back later!
--Ed--

EdTittel · 11 Sep 2016

Still chewing, but so far not getting anywhere. All I can think of is that the audit success stuff might be a red herring. Sounds like the real issue is that something, perhaps related to audit events completing successfully, is consuming most of your PC's CPU resources. I still think the process explorer/task manager (details/CPU consumption ranking) and perhaps resource manager approach to seeing what's happening on your system is likely to provide more insight. You should also take a look at the discussion in the recent TenForums thread "Windows 10 -- high CPU usage is a real issue" to see if it sheds any light on your situation.

I'll keep digging around and see if I can come up with anything more specifically focused on the symptoms you mention, especially those related to security audit success events. So far, no joy, though.

Stay tuned,
--Ed--

jacobjingle · 12 Sep 2016

Thanks Ed,

I've done some monitoring with the process explorer and resource monitor and the CPU usage is staying low 2-5 % while the beeping is occurring. All that I see of interest is spikes for the GPU up to 100% then back down. Could that be indicative that something is going on?

I use AVG free edition vs. 16 and Spybot - Search and Destroy 2.5, but I've never had problems with either of those. Did a full scan with both. . . no fix.

Thanks again for your help and thoughts. . .

jacobjingle · 12 Sep 2016

Eureka! There seemed to be no rhyme or reason to when it would beep. No specific programs, no additional CPU usage, etc. AND, since the beeps sounded identical to what happens when you unplug a USB cable, I swapped out the mouse with an old one. So far. . . no more beeps. no more freezing. Fingers crossed that this may have been a much simpler fix than originally imagined. Thanks again Ed for the help! Hope you had a nice dinner out on Saturday!

EdTittel · 13 Sep 2016

Dear JJ:
You're very welcome. Glad you were able to work it out. Failing hardware/intermittent problems can real get your tearing your hair out (and if you check my photo, you'll see those days are long behind me ;-). Hopefully, this solves your problem.
--Ed--

thetraveler · 10 Oct 2017

Just to add to this mystery, I have the exact same problem with two additional pieces of info.
These hiccups eventually slow down and stop after I've been working for a while.
I occasionally get a message that the last usb connection I made wasn't successfull.
My system has been stable for months with no new additions and no new usb connections.
I will try unplugging them one at a time to see if that changes anything.

NoamChomsky · 25 Nov 2018

Same issue here. I can't find a fix.

EDIT: I think I fixed it by swapping the ports into which the USB keyboard and USB mouse were plugged. No issues yet!

BigPackie · 29 Mar 2019

I have bough a new A4tech V7M mouse and no matter into which USB port I plug it, it always randomly disconnects or goes to sleep and when in rage I start clicking on it, it wakes up or enables itself. Every time the mouse turns of and on it makes the traditional USB sound and an Audit Success log (id: 4798). In the Device Manager I identified 3 components connected with the mouse in 3 categories: Human Interface Devices, Mice and other pointing devices, Universal Serial Bus controllers. From these categories the HID and USB controllers categories item have additional events in the properties : Device not migrated, Status: 0xC0000719. I wonder if this is causing the problem....

I have tried to reinstall the driver (actually the software called bloody which is suppose to install the correct driver) several times, even in Safe mode, without any result. I must try out if the mouse behaves the same in Safe mode.

BigPackie · 29 Mar 2019

In the save mode the mouse disconnects too, only there is not sound. Upon further investigation I noticed a more detail description. Before I also had an a4tech mouse, is it possible that some kind of residue is conflicting with the old and new mouse? Could somebody help me?

Device USB\VID_09DA&PID_1DCB\5&2444165f&0&5 was not migrated due to partial or ambiguous match.

Last Device Instance Id: USB\VID_0402&PID_9665\5&2444165f&0&5
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Location Path: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(5)
Migration Rank: 0xF000FFFF00000020
Present: false
Status: 0xC0000719

BigPackie · 30 Mar 2019

Additionally in the System events, I have a lot of UserModePowerService events:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-UserModePowerService" Guid="{CE8DEE0B-D539-4000-B0F8-77BED049C590}" />
<EventID>12</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>10</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2019-03-30T12:05:15.658605600Z" />
<EventRecordID>26211</EventRecordID>
<Correlation />
<Execution ProcessID="1016" ThreadID="1196" />
<Channel>System</Channel>
<Computer>MSI</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="ProcessPath">C:\Program Files\AVAST Software\Avast\AvastSvc.exe</Data>
<Data Name="ProcessPid">3184</Data>
<Data Name="OldSchemeGuid">{8C5E7FDA-E8BF-4A96-9A85-A6E23A8C635C}</Data>
<Data Name="NewSchemeGuid">{381B4222-F694-41F0-9685-FF5BB260DF2E}</Data>
</EventData>
</Event>

In the device manager I already turned off "Allow the computer to turn of this device to safe power" for every USB HUB and also Disabled "USB selective suspend setting" in the Power Options-> Advanced setting for my current power plan. Although as per the above events my computer (or avast) keeps switching my power plan to a different one for a very short time.

As per microsoft:
381B4222-F694-41F0-9685-FF5BB260DF2E - balanced
381B4222-F694-41F0-9685-FF5BB260DF2E - high performance

I have turned off the Avast automatic power switching in it's secret settings. Unfortunately this not solved the issue.

I also turned off SynTPenhServices which is related to the touchapad and also had a lot of events. However with all these things turned of the problem still prevails. And the Security events keeps generating, the Audit Success events, taks categories : User Account Management, Logon, Special Logon.

So I think whatever generates the Audit Success events keeps messing with my mouse, or these events might be the result of my mouse not working correctly and not the cause of it.

To summarize the problem might be:

bad driver causing my mouse to disconnect and triggering security events
something triggering security events and causing my mouse to disconnect.
mouse hardware issue

The issue regarding my driver not able to migrate, as described in my previous post still prevails.

I forgot to mention, the mouse keeps disconnecting more often if I play a game.