Windows Credentials

I am at the lookout for why my folders and files takes about 5-10 seconds to open, and I discovered a slew of security events at the same time (same second; in the Event Viewer) and I figured that while it may have nothing to do with my slowness, I might as well ask to see.

In ...

Administrative Tools > Event Viewer > Windows Logs > Security

... I have this:

Credential Manager credentials were read (among other items:

Account name: DESKTOP-xxxxxx#$ (letters: x; digits: #; $ as itself)


When I check in the Credentials Manager, this account name does not occur there (others do). Is this as it should be, or do I have older credentials that slow things down as they are searched for?

Should I delete all credentials? Would the correct ones be recreated?

Grateful for some info on this for me rather obscure issue.

Oh, Windows 10, 64-bit, v 20H2.

Hans L

The slowness started a few months ago, and it is too much time for me to remember what happened before. It seems rather random, happening only once every half hours or so on the average.

I have never changed my page file settings.

C drive: Used: 100 GB, free 378 GB.

I have no anti-malware (or the like) apps installed, just MS Defender.

I spent a few minutes in Safe Mode, and everything was so much faster. Opening file and folders were fast. Since my problem is random in time, I spent only those few minutes there.

Now, I did one thing that one should not do when trouble-shooting, and I am (kinda') sorry about that. I uninstalled a number of apps, namely XBox stuff, Apple stuff, GoMeeting stuff, and some other apps that I certainly do not need anymore. That may have solved my problem, because even in Normal Mode now, Word, for instance, opens very fast, and folders, too, open very fast (in my replacement for Win Explorer/File Explorer – Dopus – used even in SafeMode, since I had not changed the setting to replace File Explorer).

DalChina, If you see something suspicious in what I have attached or said above, please let me know, otherwise I will let you know if my problem reoccurs.

Best,

Hans L

dalchina said:

Thanks, that sounds good... that things were fine in Safe Mode immediately suggests some effect of an installed program, and it seems you were lucky enough to pick the right one.

Yes, and what I meant by "Now, I did one thing that one should not do when trouble-shooting, ..." was that one should, as you know, not do two things at the same time where either of the actions could solve the problem. At least not if you wanted to know what the problem was.

I hope I hit the jackpot!

Hans L

My problem reoccurred quickly, but I had no time to do anything about it and had, thus, nothing to post here.

Yesterday, I quickly looked in Event Viewer when there was a delay, and in Windows Logs > Security, I found this at the exact right time:

Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management

Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 4624 Logon
------------------------------------------------------------------

In one of the User Account Management, tab General, I found this:

For " User Account Management", it says, under tab "General":

Credential Manager credentials were read.

Subject:
Security ID: SYSTEM
Account Name: DESKTOP-JNCGSP4$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Read Operation: Enumerate Credentials

This event occurs when a user performs a read operation on stored credentials in Credential Manager.

=================================================
In Services, I disabled "Credential Manager", hoping it would solve my problem (and it is still disabled), but right after a delay today, I found basically the same information as above in Windows Log > Security, but also this:

An account was successfully logged on.

Subject:
Security ID: SYSTEM
Account Name: DESKTOP-JNCGSP4$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x3d8
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

--------------------------------

I know, this is a lot, but if you are familiar with it, perhaps it is not so bad.

I am not entirely sure i do not need the Credential stuff, but it would be great to be able to totally turn it off to check if it is it that slows opening files, folders and apps.

Hans L