Windows 10: Audit Success event id 4798 loging every minute

Hello, what could be cause of this ?





Every minute I see this event and every minute my desktop icons blinks
YouTube
YouTube
YouTube

How can I fix this problem?

:)

 

Event ID 4798

Hi,

Thank you for writing to Microsoft Community Forums.

Do you have any external device connected to the computer permanently, apart from Mouse and Keyboard?

As per the event logs, I suggest you to close the Chrome application completely from the task manager and then perform Clean Boot on your computer to check with the issue.

Please refer this article to perform
Clean Boot.

NOTE: Performing a clean boot will start the computer with minimal set of drivers and programs, to determine whether a background program is causing the issue. Some of the Startup programs will not load after performing
a clean boot on the computer. However, that functionality will return when you reset the computer to start normally after finishing the troubleshooting.

Please refer this article to know more about

Event ID 4798.

Please reply with the status of the issue, we will be glad to help you further.

Regards,

Noor Azam S

Microsoft Community-Moderator

 

Event ID 4798

When computer goes into screen saver mode there are repeating sounds of devices loading and unloading. Event viewer shows thousands of event ID # 4798 over a 7 day period during which time screen saver is only active maybe 10 hours during that time.
Event properties are as follows, please advise.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 1/8/2019 9:58:15 AM

Event ID: 4798

Task Category: User Account Management

Level: Information

Keywords: Audit Success

User: N/A

Computer: DESKTOP-OMFQNRD

Description:

A user's local group membership was enumerated.



Subject:

Security ID:
DESKTOP-OMFQNRD\HPUser

Account Name:
HPUser

Account Domain:
DESKTOP-OMFQNRD

Logon ID:
0x36CF3A



User:

Security ID:
DESKTOP-OMFQNRD\HPUser

Account Name:
HPUser

Account Domain:
DESKTOP-OMFQNRD



Process Information:

Process ID:
0x2860

Process Name:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

<EventID>4798</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>13824</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-01-08T14:58:15.125691500Z" />

<EventRecordID>86634</EventRecordID>

<Correlation ActivityID="{F31ED8AE-A699-0003-FBD8-1EF399A6D401}" />

<Execution ProcessID="788" ThreadID="8112" />

<Channel>Security</Channel>

<Computer>DESKTOP-OMFQNRD</Computer>

<Security />

</System>

<EventData>

<Data Name="TargetUserName">HPUser</Data>

<Data Name="TargetDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="TargetSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserName">HPUser</Data>

<Data Name="SubjectDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="SubjectLogonId">0x36cf3a</Data>

<Data Name="CallerProcessId">0x2860</Data>

<Data Name="CallerProcessName">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>

</EventData>

</Event>

 

Too Many 'Audit Success' Security-Auditing Events Happening


Hi! I've been using Windows 10 for a while now and except for one time where my start button and notification tray stopped working (solved that by migrating to a new user account), I haven't had any problems.

Except maybe a week ago.

Consistently during use (either for simple browsing or whatever), I keep hearing multiple instances of the sound I hear whenever a new device is plugged in (i.e. USB Flash Disk). It's REALLY annoying.

At first I though it was because my graphics card was failing (it is). I though that because of this, whenever my PC needed to do graphics-processing intensive tasks, like downloading a large image, the card bugged out and so the PC responded by believing that the hardware was being plugged back in and out.

Apparently, this is wrong. I finally got fed up and checked my event viewer. Everything is hunky-dory EXCEPT the 'Security' category, which has an overwhelming number of events. I then monitored it and was witness to new events being created (as signified by the sound being played). Therefore, I can reliably assume that the sound I've been hearing has actually been this event happening over and over again.

Basically, every minute or so, a new event is created. It has the Event ID of 4798, Source: Security-Auditing, Task Category: User Account Management and Keywords: Audit Success.

I have hundreds of this. Please see attached image.

Any idea what could be the problem? Thanks!