Windows 10: Audit Failure reports in Event Viewer

Since the PC upgraded to Windows 10 version 1803 build 17134.191, the event log on start up repeatedly gives the three different audit failures below. I have managed to clear all the other problems the event log has displayed but with these three I am at a lost as to the cause and what areas to check along with any actions to take. Hopefully, someone can point me in the right direction.


Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 21/08/2018 08:08:32

Event ID: 5061

Task Category: System Integrity
Level: Information

Keywords: Audit Failure

User: N/A
Computer: Home-PC

Description:
Cryptographic operation.

Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE

Account Domain: NT AUTHORITY

Logon ID: 0x3E5


Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider

Algorithm Name: UNKNOWN

Key Name: Microsoft Connected Devices Platform device certificate

Key Type: User key.


Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2018-08-21T07:08:32.104481600Z" />
<EventRecordID>6985</EventRecordID>
<Correlation />
<Execution ProcessID="744" ThreadID="852" />
<Channel>Security</Channel>
<Computer>Home-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-19</Data>
<Data Name="SubjectUserName">LOCAL SERVICE</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e5</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 21/08/2018 08:08:40

Event ID: 5061

Task Category: System Integrity
Level: Information

Keywords: Audit Failure

User: N/A
Computer: Home-PC

Description:
Cryptographic operation.

Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE

Account Domain: NT AUTHORITY

Logon ID: 0x3E5


Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN

Key Name: f00cadd0bda1ded4

Key Type: User key.


Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2018-08-21T07:08:40.159642400Z" />
<EventRecordID>7015</EventRecordID>
<Correlation />
<Execution ProcessID="744" ThreadID="856" />
<Channel>Security</Channel>
<Computer>Home-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-19</Data>
<Data Name="SubjectUserName">LOCAL SERVICE</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e5</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">f00cadd0bda1ded4</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>

Log Name: Security

Source: Microsoft-Windows-Security-Auditing
Date: 21/08/2018 08:09:40

Event ID: 5061

Task Category: System Integrity
Level: Information

Keywords: Audit Failure

User: N/A
Computer: Home-PC

Description:
Cryptographic operation.

Subject:
Security ID: Home-PC\Malcolm
Account Name: Malcolm

Account Domain: Home-PC

Logon ID: 0x20272


Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN

Key Name: Microsoft Connected Devices Platform device certificate

Key Type: User key.


Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2018-08-21T07:09:40.329788500Z" />
<EventRecordID>7040</EventRecordID>
<Correlation />
<Execution ProcessID="744" ThreadID="804" />
<Channel>Security</Channel>
<Computer>Home-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-4023029420-2456169105-2834210191-1002</Data>
<Data Name="SubjectUserName">Malcolm</Data>
<Data Name="SubjectDomainName">Home-PC</Data>
<Data Name="SubjectLogonId">0x20272</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>

:)

 

Event viewer error reporting and system audit report

After install of windows 10 event view now show several errors and system audit failures. Have anyone else noted this? As of now Microsoft when I check online they are not showing up yet. I don't see any problems with anything I do so now I'm not to worried.
Windows 7 had maybe one error a week and no system audit problems.

 

System Integrity Event 5061 Security Audit Failure

Anyone notice that with the rollup update from August 17, that the Security section of Windows Logs in Event Viewer have now all been renamed to simply "Information" instead of "Audit Failure" or "Audit Success". Ever since upgrading to Win 10, I've
been getting a lot of Audit Failures with Event ID 5061, which I presume is either related to one or more of the Nvidia drivers/programs, or is related to some other MS attempt to login to some server somewhere that fails (for reasons I've been unable to trace).
MS has been getting a lot of questions on these forums about event 5061, and apparently lots of people were alarmed about the reports of "Audit Failures" for "System Integrity", believing that it meant something was definitely wrong with their systems.

I just noticed the change in language tonight in event viewer. Now everything, and I mean all events listed under Security logs is listed as "Information". Failures still show a "lock" icon, and success shows a "gold key" icon, but the descriptions are
now simply "Information" only. You have to actually look hard to see whether it's a "failure" or "success".

Likely related, my Win10 system is unstable, and the Nvidia drivers keep crashing and recovering and then eventually crash the system. It does not seem to be at all predictable. I can be playing Solitaire, or looking at maps, or reviewing pictures in the
Bing Photo Archives, or just downloading e-mail. The computer will stay up for a day or two and then whammo. Instability, crashing and a need to continually reboot until things calm down. Oh, and throw in a couple of BSOD's too, with the message "Your
PC crashed ; (" and a report generating somewhere.

I figured Windows 10 might have some issues and I used a lot of preview builds with better luck than I'm having with a clean install of the final release version (downloaded and installed with an ISO). The machine is an older computer, running an Intel Core2
Quad processor, but it runs both Win 8.1 and Win 7 with no issues at all....I mean flawlessly. Whereas Windows 10, installed on its own partition on a clean install, is just completely unstable, and unfit at all for any production work.

 

Security Audit Failure Event 5061 In Windows 10

Hello,

A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.

The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.

Advanced Security Auditing FAQ