Page 1 of 2 12 LastLast
  1.    03 Nov 2015 #1
    Join Date : Oct 2015
    Posts : 1
    Windows 10 Pro 64bit

    Too Many 'Audit Success' Security-Auditing Events Happening


    Hi! I've been using Windows 10 for a while now and except for one time where my start button and notification tray stopped working (solved that by migrating to a new user account), I haven't had any problems.

    Except maybe a week ago.

    Consistently during use (either for simple browsing or whatever), I keep hearing multiple instances of the sound I hear whenever a new device is plugged in (i.e. USB Flash Disk). It's REALLY annoying.

    At first I though it was because my graphics card was failing (it is). I though that because of this, whenever my PC needed to do graphics-processing intensive tasks, like downloading a large image, the card bugged out and so the PC responded by believing that the hardware was being plugged back in and out.

    Apparently, this is wrong. I finally got fed up and checked my event viewer. Everything is hunky-dory EXCEPT the 'Security' category, which has an overwhelming number of events. I then monitored it and was witness to new events being created (as signified by the sound being played). Therefore, I can reliably assume that the sound I've been hearing has actually been this event happening over and over again.

    Basically, every minute or so, a new event is created. It has the Event ID of 4798, Source: Security-Auditing, Task Category: User Account Management and Keywords: Audit Success.

    I have hundreds of this. Please see attached image.

    Any idea what could be the problem? Thanks!

    Click image for larger version. 

Name:	event-viewer.jpg 
Views:	7 
Size:	224.1 KB 
ID:	46116
      My ComputerSystem Spec
  2.    10 Sep 2016 #2
    Join Date : Sep 2016
    Posts : 6
    windows 10

    same problem


    Did you ever find a solution? I'm having the identical issue with no luck searching the web for solutions. . .
      My ComputerSystem Spec
  3.    10 Sep 2016 #3

    You don't see audit success entries in Event Viewer unless you've turned security auditing on for a Windows system. This usually happens because of some audit policy or another. See this TechNet article "Basic Security Audit Policies" for more information.
    HTH,
    --Ed--
      My ComputersSystem Spec
  4.    10 Sep 2016 #4
    Join Date : Sep 2014
    Nashville, TN
    Posts : 3,143
    Windows 10 Pro

    Quote Originally Posted by EdTittel View Post
    You don't see audit success entries in Event Viewer unless you've turned security auditing on for a Windows system. This usually happens because of some audit policy or another. See this TechNet article "Basic Security Audit Policies" for more information.
    HTH,
    --Ed--
    That's not true. Security Audit messages are enabled by default. They didn't used to be, IIRC back in the XP days, but they have since at least vista. Don't believe me? Check your own security log.

    To the original posted (yikes, 2005!) this is normal. You get tons of these in the event log by default.
      My ComputerSystem Spec
  5.    10 Sep 2016 #5

    Well color me embarrassed! I just checked my security log, Mystere, and you are indeed correct. I used to write and teach about this stuff in the late 90s and early 2000s for MCSE and didn't realize the rules had changed. Further research shows that with Vista and Windows Server 2003 service pack stuff, this did indeed change. I apologize for the error and will be sure to check my facts before spouting off further on event log and other stuff. Thanks for setting things straight, Mystere: this is completely a matter of "stale info" on my part.

    As for the original issue, because auditing is turned on by default, this behavior is completely normal and exactly what you want to see in the Security log. Any time you successfully access an encrypted object or read its associated key from the file where it's stored you'll get this event. I see hundreds per day in my security log, along with an equal number of "Logon" and "Special Logon" events associated with normal system operation. The real question then becomes (I think): Why do these events trigger some kind of system sound? This is a new one on me, so I'll ask other members of the community to chime in. Never came across anything like this before myself ... goes off to search ... can't find anything directly relevant, either.
    --Ed--
      My ComputersSystem Spec
  6.    10 Sep 2016 #6
    Join Date : Sep 2016
    Posts : 6
    windows 10

    thanks for the help - After several false starts I've identified the security policy settings - as below - "No auditing" is still set as the default. Yet the problem persists. do you see anything askew?
      My ComputerSystem Spec
  7.    10 Sep 2016 #7

    As Mystere has observed, auditing is now turned on by default for various classes of security events. Presumably, this is something that doesn't require a policy to occur since it's addressed by fiat in the default behavior of Windows. Thus, the fact that it's occurring is entirely normal and expected. So, no problems there. What's interesting is the associated sounds it's producing, if I've understood your posts correctly. I would agree that this is indeed problematic, but I'll be darned if I can find any information on how to set this up, or turn this off. It's about as senseless as emitting a system sound for every keypress or IP packet sent/received: it represents an audible flag for something normal and frequent, so is bound to be irritating. This one has me stumped...and intrigued. Keep us posted!
    Sorry,
    --Ed--
      My ComputersSystem Spec
  8.    10 Sep 2016 #8
    Join Date : Sep 2016
    Posts : 6
    windows 10

    Thanks for the help. I verified that auditing was not set. Still getting the "audible warning" and a 2-4 second lag where the cursor disappears. At the conclusion of the sounds I get a record for each one - see below. 32,227 events! any more suggestions? this is driving the family nuts.
      My ComputerSystem Spec
  9.    10 Sep 2016 #9

    Darn! That's a huge encrypted string for a base64 image; it also won't decode for me in any of the Base64 decoder tools I try. I can't see the actual original material, so you may want to try reposting. Or, you can e-mail it to me through ed at edtittel dot com if you want to send it to me direct (I am taking my family out to dinner in 20 minutes, so I may not be able to dig into this until after we get back later this evening). My flippant but hopefully helpful suggestion for the time being is to turn the computer audio off or way down low.
    HTH,
    --Ed--
      My ComputersSystem Spec
  10.    10 Sep 2016 #10
    Join Date : Sep 2016
    Posts : 6
    windows 10

    Thanks again. The sounds not the real issue (just helped me identify what was going on) it's the fact that the machine effectively locks up for a few seconds every time it happens. I re-posted below as JPEG


    Click image for larger version. 

Name:	Capture 2.JPG 
Views:	9 
Size:	57.8 KB 
ID:	100843Click image for larger version. 

Name:	Capture.JPG 
Views:	1 
Size:	42.6 KB 
ID:	100844
      My ComputerSystem Spec

 
Page 1 of 2 12 LastLast


Similar Threads
Thread Forum
Solved BIOS startup not happening
Until I did a Windows 10 fresh install my PC was set in the BIOS (and still remains the same) set to startup the PC at a predetermined time everyday. ASROCK H77. And it did so daily until the Windows 10 Pro install. Did the update first to activate....
General Support
Bsod Relating To ntoskrnl.exe Been Happening For A While Please Help
41467
BSOD Crashes and Debugging
Turning on security audit logs for folders/Alsofiles
Recently I lost an entire folder full of folders and files and as of right now I still don't know what happened. I have re-created the folder and starting re-adding the files in it but I'd like to turn on auditing for the folder, to include all...
General Support
BSOD happening every day now
I started getting this bsod a few weeks ago. Lately the screen is unreadable when everything crashes however before it started doing that I would get WHEA_uncorrectable_error. Any help would be appreciated. I've attached the debug folder like...
BSOD Crashes and Debugging
NCC Group to audit OpenSSL for security holes
Read more: NCC Group to audit OpenSSL for security holes | ZDNet
Windows 10 News
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 22:20.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums