Windows 10: Audit Failure EventID: 4625 Login

I am getting a large number of Audit Failures being logged. The entire log view actually

The Source Network Address varies, but it isn't something that would be related to anything I do. See the one below. Is this a hacking attempt?

Is this because I have a port open on my router to allow for RDP? Another computer on this (home) network is not experiencing this.



:)

 

Audit failure 5061 after logging in to Windows 10

Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.

There's no time to read it as the login succeeds.

In the event log I see:

It says the key type is a user key.

Inside the 5061 Audit failure is the following information:

The details tab contains

What is going on, and how do I fix it?

 

Event 4625 keeps happening every day at (nearly) the same time

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that you are getting the Event ID 4625 on your PC at a specific time.



I have been researching on this and found some information which might be helpful for you. You can refer the article

4625(F): An account failed to log on



However, as you have mentioned that the Event ID is getting triggered at a particular time there are possibilities that a task is being executed at that time interval. I would suggest you to check the task scheduler and see if any task is executed
at that time.

1. Press Windows + S key together and type
   Task Scheduler.
   
2. Now on the left hand pane click on Task Scheduler (local).
   
3. Now under Task Status select the drop down for
   Last 24 hours/Last hour and check if any task is executing at
   1 PM.
   

Please get back to us with the detailed information to assist you further.



We await your response.



Regards,

Prakhar Khare

Microsoft Community – Moderator

 

Audit failures every reboot - Event 5061 - Cryptographic operation.

Before I upgrade my 10 to the Spring version, I did some more digging.

I looked at the sequence of Audit Successes before and after each Audit Failure - maybe they're related? Maybe the steps mean something? In the link below, I have pasted the "General" subwindows for the Event Viewer events closely preceding, including and following each of the two Audit Failures in my most recent bootup.

There seems to be some kind of pattern of the machine looking at the key, DELETING it, then looking for it again, then throwing the AUDIT FAILURE - maybe because it just deleted the key and the key isn't there any more - and then re-creating the key. Is the AUDIT FAILURE just the good result of a test that the key was successfully deleted?

But WHY is the machine doing this? Why delete and recreate? What's really going on?

Here's the link to the Word Online document in which I've pasted both Event Viewer sequences:
<THIS LINK>

Any thoughts? (And am I interpreting the events correctly anyway?)