Audit failures every reboot - Event 5061 - Cryptographic operation.

Page 1 of 5 123 ... LastLast

  1. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
       New #1

    Audit failures every reboot - Event 5061 - Cryptographic operation.


    Audit failures every reboot - Event 5061 - Cryptographic operation. Win 10 Pro 64-bit version 1803. ‎4/‎28/‎2019

    Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography. So my Win 10 machine is insecure? I have run sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck. And I hardly even use my Win 10 machine - there are almost no apps on it yet. My actual Win 10 build is 17134.706

    Here are the latest five Cryptography-related Audit Failures, from two reboots:

    LATEST OF FIVE:
    Log Name: Security
    Source: Microsoft-Windows-Security-Auditing
    Date: 4/28/2019 12:27:52 PM
    Event ID: 5061
    Task Category: System Integrity
    Level: Information
    Keywords: Audit Failure
    User: N/A
    Computer: DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
    Security ID: DESKTOP-3#####N\[My user name]
    Account Name: [My user name]
    Account Domain: DESKTOP-3#####N
    Logon ID: 0x3EC24

    Cryptographic Parameters:
    Provider Name: Microsoft Software Key Storage Provider
    Algorithm Name: UNKNOWN
    Key Name: Microsoft Connected Devices Platform device certificate
    Key Type: User key.

    Cryptographic Operation:
    Operation: Open Key.
    Return Code: 0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-28T16:27:52.339705400Z" />
    <EventRecordID>19582</EventRecordID>
    <Correlation />
    <Execution ProcessID="880" ThreadID="948" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-3#####N</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-3591163430-416291016-3566129944-1001</Data>
    <Data Name="SubjectUserName">[My user name]</Data>
    <Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
    <Data Name="SubjectLogonId">0x3ec24</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
    </EventData>
    </Event>


    FOURTH OF FIVE:
    Log Name: Security
    Source: Microsoft-Windows-Security-Auditing
    Date: 4/28/2019 12:26:51 PM
    Event ID: 5061
    Task Category: System Integrity
    Level: Information
    Keywords: Audit Failure
    User: N/A
    Computer: DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
    Security ID: LOCAL SERVICE
    Account Name: LOCAL SERVICE
    Account Domain: NT AUTHORITY
    Logon ID: 0x3E5

    Cryptographic Parameters:
    Provider Name: Microsoft Software Key Storage Provider
    Algorithm Name: UNKNOWN
    Key Name: [Hex number]
    Key Type: User key.

    Cryptographic Operation:
    Operation: Open Key.
    Return Code: 0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-28T16:26:51.704606400Z" />
    <EventRecordID>19552</EventRecordID>
    <Correlation />
    <Execution ProcessID="880" ThreadID="1004" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-3#####N</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="SubjectUserSid">S-1-5-19</Data>
    <Data Name="SubjectUserName">LOCAL SERVICE</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e5</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">[Hex number]</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
    </EventData>
    </Event>


    THIRD OF FIVE:
    Log Name: Security
    Source: Microsoft-Windows-Security-Auditing
    Date: 4/28/2019 11:29:28 AM
    Event ID: 5061
    Task Category: System Integrity
    Level: Information
    Keywords: Audit Failure
    User: N/A
    Computer: DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
    Security ID: DESKTOP-3#####N\[My user name]
    Account Name: [My user name]
    Account Domain: DESKTOP-3#####N
    Logon ID: 0x3EF94

    Cryptographic Parameters:
    Provider Name: Microsoft Software Key Storage Provider
    Algorithm Name: UNKNOWN
    Key Name: Microsoft Connected Devices Platform device certificate
    Key Type: User key.

    Cryptographic Operation:
    Operation: Open Key.
    Return Code: 0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-28T15:29:28.196237300Z" />
    <EventRecordID>19387</EventRecordID>
    <Correlation />
    <Execution ProcessID="884" ThreadID="928" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-3#####N</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-3591163430-416291016-3566129944-1001</Data>
    <Data Name="SubjectUserName">[My user name]</Data>
    <Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
    <Data Name="SubjectLogonId">0x3ef94</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
    </EventData>
    </Event>


    SECOND OF FIVE:
    Log Name: Security
    Source: Microsoft-Windows-Security-Auditing
    Date: 4/28/2019 11:28:27 AM
    Event ID: 5061
    Task Category: System Integrity
    Level: Information
    Keywords: Audit Failure
    User: N/A
    Computer: DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
    Security ID: LOCAL SERVICE
    Account Name: LOCAL SERVICE
    Account Domain: NT AUTHORITY
    Logon ID: 0x3E5

    Cryptographic Parameters:
    Provider Name: Microsoft Software Key Storage Provider
    Algorithm Name: UNKNOWN
    Key Name: [Hex number]
    Key Type: User key.

    Cryptographic Operation:
    Operation: Open Key.
    Return Code: 0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
    <EventRecordID>19363</EventRecordID>
    <Correlation />
    <Execution ProcessID="884" ThreadID="992" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-3#####N</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="SubjectUserSid">S-1-5-19</Data>
    <Data Name="SubjectUserName">LOCAL SERVICE</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e5</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">[Hex number]</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
    </EventData>
    </Event>


    FIRST OF FIVE:
    Log Name: Security
    Source: Microsoft-Windows-Security-Auditing
    Date: 4/28/2019 11:28:27 AM
    Event ID: 5061
    Task Category: System Integrity
    Level: Information
    Keywords: Audit Failure
    User: N/A
    Computer: DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
    Security ID: LOCAL SERVICE
    Account Name: LOCAL SERVICE
    Account Domain: NT AUTHORITY
    Logon ID: 0x3E5

    Cryptographic Parameters:
    Provider Name: Microsoft Software Key Storage Provider
    Algorithm Name: UNKNOWN
    Key Name: [Hex number]
    Key Type: User key.

    Cryptographic Operation:
    Operation: Open Key.
    Return Code: 0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
    <EventRecordID>19363</EventRecordID>
    <Correlation />
    <Execution ProcessID="884" ThreadID="992" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-3#####N</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="SubjectUserSid">S-1-5-19</Data>
    <Data Name="SubjectUserName">LOCAL SERVICE</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e5</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">[Hex number]</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
    </EventData>
    </Event>

    So, what the *** are these, and how do we fix? No guesses - just the real fix.

    Thanks.
    Last edited by glnz; 03 May 2019 at 16:38.
      My Computer
    Quote Quote

  3. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #2

    Bump.
      My Computer
    Quote Quote

  4. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #3

    I did some more digging.

    On reboot just now, there were three Audit Failures, Event 5061, for Cryptographic operation, all noting Process ID 888, which is lsass.exe, Local Security Authority Process
    So I right-clicked on lsass.exe and looked at its related services, and they are:
    Keylso - CNG Key Isolation - running
    SamSs - Security Account Manager - running
    VaultSvc - Credential Manager - running
    Any ideas what this is, or how to fix?
      My Computer
    Quote Quote

  6. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #4

    Update – in the detailed copies of the Audit Failure messages at the start here, the [Hex number] is associated with my One Drive, as I discovered in the registry.

    Is that a clue to the reason for the Audit Failures?

    UPDATE - I tried rebooting without OneDrive starting, but that did not help. Still got the AUDIT FAILURES.
    Last edited by glnz; 05 May 2019 at 07:29.
      My Computer
    Quote Quote

  7. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #5

    IMPORTANT NEW INFO:

    By checking my logs carefully, I can see that the Audit Failures start on the same day that I upgraded from Win 10 Version 1709 to Version 1803 - this past March 17.

    So is this problem baked into 1803?

    But why haven't more people been complaining about it?

    Still need to know how to fix. Thanks.
      My Computer
    Quote Quote

  8. fdegrove
    Posts : 2,832
    Windows 10 Pro X64
       New #6

    Hi,

    Does this help you in any way?

    https://docs.microsoft.com/en-us/win...ing/event-5061

    Cheers,
      My Computers
    Quote Quote

  9. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #7

    fdegrove - thanks for looking. You were fast to suggest that MS "doc", which is certainly a good source of info.
    Problem is that I don't know what to do with it - not clear to me what to do to fix the Audit Failures.
    Buy the way, when I run “certutil -store -user my” in Power Shell, I don't get the info you see in the doc. I just get "Certutil: -store command completed successfully."
    Well, that's nice, but ... ?
    Any suggestions?
      My Computer
    Quote Quote

  10. fdegrove
    Posts : 2,832
    Windows 10 Pro X64
       New #8

    Hi,

    Are you running any or both of these ?

    Microsoft Software Key Storage Provider

    Microsoft Smart Card Key Storage Provider

    If you do not then I really do not know why your system is generating those errors.

    Cheers,
      My Computers
    Quote Quote

  12. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #9

    fdegrove -
    1. In my Task Manager, nothing like them in Details (processes).
    2. In my Task Manager, nothing like them in Services, except for the following five:
      1. SCardSvr - Smart Card - status "Stopped"
      2. ScDeviceEnum - Smart Card Device Enumeration Service - status "Stopped"
      3. SCPolicySvc - Smart Card Removal Policy - status "Stopped"
      4. StorSvc - Storage Service - status "Running"
      5. TieringEngineService - Storage Tiers Management - status "Stopped"

    3. Don't see anything relevant in "Programs and Features" or "Turn Windows features on or off".


    By the way, the [Hex number] I noted in my first post has something to do with OneDrive, which IS running. However, when I rebooted one time yesterday WITHOUT OneDrive starting on startup, I still got the Audit Failures.

    Where else should I look?
      My Computer
    Quote Quote

  13. glnz
    Posts : 318
    Dual-boot Win 7 & 10, both Pro 64-bit, now with a Hyper-V VM of Win 11
    Thread Starter
       New #10

    Is it because I'm missing a Certificate? If I go to certmgr.msc, I don't see any Certificates that mention Microsoft Software Key Storage Provider or Smart Card. But should I?
    Also, certmgr.msc gives me a folder list on the left. The last one is Smart Card Trusted Roots, but it's empty.
      My Computer
    Quote Quote

 

  Related Discussions
Okay so this morning I began getting these messages in my event viewer after my PC decided to update to April update. They seem to happen after reboot and boot up. Also trying to updated Defender definitions is kinda not happening. I even...
Security Log Audit Failures 5127
in Network and Sharing

Access Denied or to whoever can shed some light on this issue, Here we go, a little more information on what is going on with this one machine on my home network. I have restarted all the services. In a previous post I uninstalled all the...
Okay so I have noticed that ever since I installed the Creators Update on Tuesday I have gotten Event ID 6281 which say the following. Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly...
Event Viewer -- Audit Failure 5061
in Performance & Maintenance

I continue to get this event in the Event Log under Audit Failure. I never had in Windows 8.1 and it started after upgrading to 10. Does anyone have a clue about it? Cryptographic operation. Subject: Security ID: SYSTEM Account...
Audit Failure 5061
in General Support

I keep getting this Audit failure 5061. Cryptographic operation. Subject: Security ID: SYSTEM Account Name: DOCOMO$ Account Domain: WORKGROUP Logon ID: 0x3E7
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 03:06.
Find Us




Windows 10 Forums