Too Many 'Audit Success' Security-Auditing Events Happening

Page 1 of 3 123 LastLast

  1. Posts : 6
    Windows 10 Pro 64bit
       #1

    Too Many 'Audit Success' Security-Auditing Events Happening


    Hi! I've been using Windows 10 for a while now and except for one time where my start button and notification tray stopped working (solved that by migrating to a new user account), I haven't had any problems.

    Except maybe a week ago.

    Consistently during use (either for simple browsing or whatever), I keep hearing multiple instances of the sound I hear whenever a new device is plugged in (i.e. USB Flash Disk). It's REALLY annoying.

    At first I though it was because my graphics card was failing (it is). I though that because of this, whenever my PC needed to do graphics-processing intensive tasks, like downloading a large image, the card bugged out and so the PC responded by believing that the hardware was being plugged back in and out.

    Apparently, this is wrong. I finally got fed up and checked my event viewer. Everything is hunky-dory EXCEPT the 'Security' category, which has an overwhelming number of events. I then monitored it and was witness to new events being created (as signified by the sound being played). Therefore, I can reliably assume that the sound I've been hearing has actually been this event happening over and over again.

    Basically, every minute or so, a new event is created. It has the Event ID of 4798, Source: Security-Auditing, Task Category: User Account Management and Keywords: Audit Success.

    I have hundreds of this. Please see attached image.

    Any idea what could be the problem? Thanks!

    Too Many 'Audit Success' Security-Auditing Events Happening-event-viewer.jpg
      My Computer


  2. Posts : 6
    windows 10
       #2

    same problem


    Did you ever find a solution? I'm having the identical issue with no luck searching the web for solutions. . .
      My Computer


  3. Posts : 4,224
    Windows 10
       #3

    You don't see audit success entries in Event Viewer unless you've turned security auditing on for a Windows system. This usually happens because of some audit policy or another. See this TechNet article "Basic Security Audit Policies" for more information.
    HTH,
    --Ed--
      My Computers


  4. Posts : 3,257
    Windows 10 Pro
       #4

    EdTittel said:
    You don't see audit success entries in Event Viewer unless you've turned security auditing on for a Windows system. This usually happens because of some audit policy or another. See this TechNet article "Basic Security Audit Policies" for more information.
    HTH,
    --Ed--
    That's not true. Security Audit messages are enabled by default. They didn't used to be, IIRC back in the XP days, but they have since at least vista. Don't believe me? Check your own security log.

    To the original posted (yikes, 2005!) this is normal. You get tons of these in the event log by default.
      My Computer


  5. Posts : 4,224
    Windows 10
       #5

    Well color me embarrassed! I just checked my security log, Mystere, and you are indeed correct. I used to write and teach about this stuff in the late 90s and early 2000s for MCSE and didn't realize the rules had changed. Further research shows that with Vista and Windows Server 2003 service pack stuff, this did indeed change. I apologize for the error and will be sure to check my facts before spouting off further on event log and other stuff. Thanks for setting things straight, Mystere: this is completely a matter of "stale info" on my part.

    As for the original issue, because auditing is turned on by default, this behavior is completely normal and exactly what you want to see in the Security log. Any time you successfully access an encrypted object or read its associated key from the file where it's stored you'll get this event. I see hundreds per day in my security log, along with an equal number of "Logon" and "Special Logon" events associated with normal system operation. The real question then becomes (I think): Why do these events trigger some kind of system sound? This is a new one on me, so I'll ask other members of the community to chime in. Never came across anything like this before myself ... goes off to search ... can't find anything directly relevant, either.
    --Ed--
      My Computers


  6. Posts : 6
    windows 10
       #6

    thanks for the help - After several false starts I've identified the security policy settings - as below - "No auditing" is still set as the default. Yet the problem persists. do you see anything askew?
      My Computer


  7. Posts : 4,224
    Windows 10
       #7

    As Mystere has observed, auditing is now turned on by default for various classes of security events. Presumably, this is something that doesn't require a policy to occur since it's addressed by fiat in the default behavior of Windows. Thus, the fact that it's occurring is entirely normal and expected. So, no problems there. What's interesting is the associated sounds it's producing, if I've understood your posts correctly. I would agree that this is indeed problematic, but I'll be darned if I can find any information on how to set this up, or turn this off. It's about as senseless as emitting a system sound for every keypress or IP packet sent/received: it represents an audible flag for something normal and frequent, so is bound to be irritating. This one has me stumped...and intrigued. Keep us posted!
    Sorry,
    --Ed--
      My Computers


  8. Posts : 6
    windows 10
       #8

    Thanks for the help. I verified that auditing was not set. Still getting the "audible warning" and a 2-4 second lag where the cursor disappears. At the conclusion of the sounds I get a record for each one - see below. 32,227 events! any more suggestions? this is driving the family nuts.
      My Computer


  9. Posts : 4,224
    Windows 10
       #9

    Darn! That's a huge encrypted string for a base64 image; it also won't decode for me in any of the Base64 decoder tools I try. I can't see the actual original material, so you may want to try reposting. Or, you can e-mail it to me through ed at edtittel dot com if you want to send it to me direct (I am taking my family out to dinner in 20 minutes, so I may not be able to dig into this until after we get back later this evening). My flippant but hopefully helpful suggestion for the time being is to turn the computer audio off or way down low.
    HTH,
    --Ed--
      My Computers


  10. Posts : 6
    windows 10
       #10

    Thanks again. The sounds not the real issue (just helped me identify what was going on) it's the fact that the machine effectively locks up for a few seconds every time it happens. I re-posted below as JPEG


    Too Many 'Audit Success' Security-Auditing Events Happening-capture-2.jpgToo Many 'Audit Success' Security-Auditing Events Happening-capture.jpg
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 15:48.
Find Us




Windows 10 Forums