Too Many 'Audit Success' Security-Auditing Events Happening

Page 2 of 3 FirstFirst 123 LastLast
  1.    #11

    Ouch! Now I'm starting to understand more fully why this is making you miserable. I'll chew on this over dinner and get back to you later this evening with any thoughts I might come up with. In the meantime, you might want to grab the Sysinternals Process Explorer and watch it along with Resource Monitor (built into Windows) to see what's happening with your CPU as these hiccups are occurring. This might give some insight into where the resources are being consumed.
    Back later!
    --Ed--
      My ComputersSystem Spec

  2.    #12

    Still chewing, but so far not getting anywhere. All I can think of is that the audit success stuff might be a red herring. Sounds like the real issue is that something, perhaps related to audit events completing successfully, is consuming most of your PC's CPU resources. I still think the process explorer/task manager (details/CPU consumption ranking) and perhaps resource manager approach to seeing what's happening on your system is likely to provide more insight. You should also take a look at the discussion in the recent TenForums thread "Windows 10 -- high CPU usage is a real issue" to see if it sheds any light on your situation.

    I'll keep digging around and see if I can come up with anything more specifically focused on the symptoms you mention, especially those related to security audit success events. So far, no joy, though.

    Stay tuned,
    --Ed--
      My ComputersSystem Spec

  3.    #13

    Thanks Ed,

    I've done some monitoring with the process explorer and resource monitor and the CPU usage is staying low 2-5 % while the beeping is occurring. All that I see of interest is spikes for the GPU up to 100% then back down. Could that be indicative that something is going on?

    I use AVG free edition vs. 16 and Spybot - Search and Destroy 2.5, but I've never had problems with either of those. Did a full scan with both. . . no fix.

    Thanks again for your help and thoughts. . .
      My ComputerSystem Spec

  4.    #14

    Eureka! There seemed to be no rhyme or reason to when it would beep. No specific programs, no additional CPU usage, etc. AND, since the beeps sounded identical to what happens when you unplug a USB cable, I swapped out the mouse with an old one. So far. . . no more beeps. no more freezing. Fingers crossed that this may have been a much simpler fix than originally imagined. Thanks again Ed for the help! Hope you had a nice dinner out on Saturday!
      My ComputerSystem Spec

  5.    #15

    Dear JJ:
    You're very welcome. Glad you were able to work it out. Failing hardware/intermittent problems can real get your tearing your hair out (and if you check my photo, you'll see those days are long behind me ;-). Hopefully, this solves your problem.
    --Ed--
      My ComputersSystem Spec

  6.    #16

    Just to add to this mystery, I have the exact same problem with two additional pieces of info.
    These hiccups eventually slow down and stop after I've been working for a while.
    I occasionally get a message that the last usb connection I made wasn't successfull.
    My system has been stable for months with no new additions and no new usb connections.
    I will try unplugging them one at a time to see if that changes anything.
      My ComputerSystem Spec


  7.    #17

    Same issue here. I can't find a fix.

    EDIT: I think I fixed it by swapping the ports into which the USB keyboard and USB mouse were plugged. No issues yet!
      My ComputerSystem Spec

  8.    #18

    I have bough a new A4tech V7M mouse and no matter into which USB port I plug it, it always randomly disconnects or goes to sleep and when in rage I start clicking on it, it wakes up or enables itself. Every time the mouse turns of and on it makes the traditional USB sound and an Audit Success log (id: 4798). In the Device Manager I identified 3 components connected with the mouse in 3 categories: Human Interface Devices, Mice and other pointing devices, Universal Serial Bus controllers. From these categories the HID and USB controllers categories item have additional events in the properties : Device not migrated, Status: 0xC0000719. I wonder if this is causing the problem....

    I have tried to reinstall the driver (actually the software called bloody which is suppose to install the correct driver) several times, even in Safe mode, without any result. I must try out if the mouse behaves the same in Safe mode.
      My ComputerSystem Spec

  9.    #19

    In the save mode the mouse disconnects too, only there is not sound. Upon further investigation I noticed a more detail description. Before I also had an a4tech mouse, is it possible that some kind of residue is conflicting with the old and new mouse? Could somebody help me?

    Device USB\VID_09DA&PID_1DCB\5&2444165f&0&5 was not migrated due to partial or ambiguous match.

    Last Device Instance Id: USB\VID_0402&PID_9665\5&2444165f&0&5
    Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
    Location Path: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(5)
    Migration Rank: 0xF000FFFF00000020
    Present: false
    Status: 0xC0000719
      My ComputerSystem Spec

  10.    #20

    Additionally in the System events, I have a lot of UserModePowerService events:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-UserModePowerService" Guid="{CE8DEE0B-D539-4000-B0F8-77BED049C590}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-30T12:05:15.658605600Z" />
    <EventRecordID>26211</EventRecordID>
    <Correlation />
    <Execution ProcessID="1016" ThreadID="1196" />
    <Channel>System</Channel>
    <Computer>MSI</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    - <EventData>
    <Data Name="ProcessPath">C:\Program Files\AVAST Software\Avast\AvastSvc.exe</Data>
    <Data Name="ProcessPid">3184</Data>
    <Data Name="OldSchemeGuid">{8C5E7FDA-E8BF-4A96-9A85-A6E23A8C635C}</Data>
    <Data Name="NewSchemeGuid">{381B4222-F694-41F0-9685-FF5BB260DF2E}</Data>
    </EventData>
    </Event>


    In the device manager I already turned off "Allow the computer to turn of this device to safe power" for every USB HUB and also Disabled "USB selective suspend setting" in the Power Options-> Advanced setting for my current power plan. Although as per the above events my computer (or avast) keeps switching my power plan to a different one for a very short time.

    As per microsoft:
    381B4222-F694-41F0-9685-FF5BB260DF2E - balanced
    381B4222-F694-41F0-9685-FF5BB260DF2E - high performance

    I have turned off the Avast automatic power switching in it's secret settings. Unfortunately this not solved the issue.

    I also turned off SynTPenhServices which is related to the touchapad and also had a lot of events. However with all these things turned of the problem still prevails. And the Security events keeps generating, the Audit Success events, taks categories : User Account Management, Logon, Special Logon.

    So I think whatever generates the Audit Success events keeps messing with my mouse, or these events might be the result of my mouse not working correctly and not the cause of it.

    To summarize the problem might be:
    • bad driver causing my mouse to disconnect and triggering security events
    • something triggering security events and causing my mouse to disconnect.
    • mouse hardware issue


    The issue regarding my driver not able to migrate, as described in my previous post still prevails.

    I forgot to mention, the mouse keeps disconnecting more often if I play a game.
    Last edited by BigPackie; 30 Mar 2019 at 08:17.
      My ComputerSystem Spec


 
Page 2 of 3 FirstFirst 123 LastLast

Related Threads
Solved BIOS startup not happening in General Support
Until I did a Windows 10 fresh install my PC was set in the BIOS (and still remains the same) set to startup the PC at a predetermined time everyday. ASROCK H77. And it did so daily until the Windows 10 Pro install. Did the update first to activate....
Recently I lost an entire folder full of folders and files and as of right now I still don't know what happened. I have re-created the folder and starting re-adding the files in it but I'd like to turn on auditing for the folder, to include all...
BSOD happening every day now in BSOD Crashes and Debugging
I started getting this bsod a few weeks ago. Lately the screen is unreadable when everything crashes however before it started doing that I would get WHEA_uncorrectable_error. Any help would be appreciated. I've attached the debug folder like...
Read more: NCC Group to audit OpenSSL for security holes | ZDNet
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 08:16.
Find Us