Windows 10: seeing hundreds of type 5 logins from services.exe under SYSTEM in wazuh

Every time i open the wazuh threat hunting tab, per machine i will see hundreds of type 5 login alerts daily, these machines are only remotely accessed by employees"An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MAGNIOFFICE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Virtual Account: No Elevated Token: Yes Impersonation Level: Impersonation New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Linked Logon ID: 0x0 Network Account Name: - Network Account Dom

:)

 

5 min delay on cold start between login screen and bg screen

Ok, let the powershell command run overnight
If the command didn't solve the problem, the try these steps in order:

1. Disable superfetch service
   • Empty the following folder c:\Windows\Prefetch\
   • Restart the computer
   • Si ça ne marche pas, passer à l'étape 2;
2. Disable the AppXSvc from the registry: change the "Start" key value from 3 to 4 (see the screenshot)

 

Windows 10 pro 64 "the audio service is not running" every 5 minutes

Hi,

Thank you for posting your query in Microsoft Community.

Sorry for the inconvenience caused. I will assist you with this.

First lets make sure the Windows Audio service
is running or not.

• Search for Services in the search bar and search Windows Audio service
  in the list of services.
• Right-click on the Windows Audio service, and then click Properties.
• On the General tab, next to Startup type, make sure that Automatic
  is selected.
• Also make sure that the service is started

Also suggest you to try the steps below and see if It helps to resolve issue with Audio Issues.

Fix sound or audio problems in Windows - Microsoft Support

For the issue related o edge I suggest you to try to restart Microsoft Edge Browser.

• Open task manager right click on Microsoft Edge and go to details click on microsoftedgeCP.exe and click end task.
• Restart your Computer and check if it helps.
  

This issue may also happen due to system file corruption. I suggest you to run System file checker. System File checker (SFC) scan is done to check if there are any corrupted system files that could be causing this issue. Kindly
follow the below given steps:

• 
  Press Windows key + X, select
  Command prompt (Admin) to bring up elevated Command prompt.
  
• 
  In Command prompt type
  sfc/scannow and press enter.
  
• 
  Restart the computer.
  

Hope the above information helps. Reply with necessary information and the result to help you further. Thank you.

 

Location service is greyed out

Hi Shahriar,

Thank you for responding.

Sorry for the inconvenience caused for you, I suggest you to try the below troubleshooting steps and check If it helps.

Step 1: Steps to turn on the Location settings.

• Login as an administrator.
• Press Windows key, type Location settings and select
  Change location settings.
• Check whether Location for this device is On by clicking on
  Change.
• Also turn on Location as well.

Step 2: And as you are unable to set the service Geolocation service to automatic, I suggest you to run SFC scan and check.

System File Checker is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files.

Follow the below steps:

• 
  Right click on the Start button, click on
  Command Prompt (Admin).
  
• 
  Type “sfc /scannow” without the quotes and hit
  Enter.
  
• 
  After the scan, restart the computer and check for the issue.
  

Try to set the service to automatic by following the steps provided in the above post by Praveen Venugopal.

Hope it helps. Kindly update the status of the issue, we will be happy to help you.