Windows 10: Crash after Windows audit

After replacing my primary drive with a new SSD and a fresh installation of Windows 10 several months ago, usually once a day or so my display will go completely black, followed shortly by loss of audio and peripheries (interactive LEDs on my keyboard) freezing. All my drivers that I'm aware of are up to date and neither SFC scan nor DISM have found or resolved any problems. The crashes are sporadic, it will happen while idle, video games, running Autodesk Maya, Chrome, the only constant is that each crash is preceded by a series of Windows audits that begin simultaneously, ID 4624 followed immediately by ID 4672 in the security log. I know that these audits are harmless and supposed to run, but that's the only thing left to be addressed.


Here are the security logs for the audits:


Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 9/6/2019 9:56:31 PM

Event ID: 4624

Task Category: Logon

Level: Information

Keywords: Audit Success

User: N/A

Computer: Chaser

Description:

An account was successfully logged on.



Subject:

Security ID: SYSTEM

Account Name: CHASER$

Account Domain: WORKGROUP

Logon ID: 0x3E7



Logon Information:

Logon Type: 5

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: Yes



Impersonation Level: Impersonation



New Logon:

Security ID: SYSTEM

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3E7

Linked Logon ID: 0x0

Network Account Name: -

Network Account Domain: -

Logon GUID: {00000000-0000-0000-0000-000000000000}



Process Information:

Process ID: 0x458

Process Name: C:\Windows\System32\services.exe



Network Information:

Workstation Name: -

Source Network Address: -

Source Port: -



Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0



This event is generated when a logon session is created. It is generated on the computer that was accessed.



The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.



The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).



The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.



The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.



The impersonation level field indicates the extent to which a process in the logon session can impersonate.



The authentication information fields provide detailed information about this specific logon request.

- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

<EventID>4624</EventID>

<Version>2</Version>

<Level>0</Level>

<Task>12544</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-09-07T02:56:31.786366100Z" />

<EventRecordID>150740</EventRecordID>

<Correlation ActivityID="{61036ade-6526-0004-ef6a-03612665d501}" />

<Execution ProcessID="1132" ThreadID="1236" />

<Channel>Security</Channel>

<Computer>Chaser</Computer>

<Security />

</System>

<EventData>

<Data Name="SubjectUserSid">S-1-5-18</Data>

<Data Name="SubjectUserName">CHASER$</Data>

<Data Name="SubjectDomainName">WORKGROUP</Data>

<Data Name="SubjectLogonId">0x3e7</Data>

<Data Name="TargetUserSid">S-1-5-18</Data>

<Data Name="TargetUserName">SYSTEM</Data>

<Data Name="TargetDomainName">NT AUTHORITY</Data>

<Data Name="TargetLogonId">0x3e7</Data>

<Data Name="LogonType">5</Data>

<Data Name="LogonProcessName">Advapi </Data>

<Data Name="AuthenticationPackageName">Negotiate</Data>

<Data Name="WorkstationName">-</Data>

<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>

<Data Name="TransmittedServices">-</Data>

<Data Name="LmPackageName">-</Data>

<Data Name="KeyLength">0</Data>

<Data Name="ProcessId">0x458</Data>

<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>

<Data Name="IpAddress">-</Data>

<Data Name="IpPort">-</Data>

<Data Name="ImpersonationLevel">%%1833</Data>

<Data Name="RestrictedAdminMode">-</Data>

<Data Name="TargetOutboundUserName">-</Data>

<Data Name="TargetOutboundDomainName">-</Data>

<Data Name="VirtualAccount">%%1843</Data>

<Data Name="TargetLinkedLogonId">0x0</Data>

<Data Name="ElevatedToken">%%1842</Data>

</EventData>

</Event>





Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 9/6/2019 9:56:31 PM

Event ID: 4672

Task Category: Special Logon

Level: Information

Keywords: Audit Success

User: N/A

Computer: Chaser

Description:

Special privileges assigned to new logon.



Subject:

Security ID: SYSTEM

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3E7



Privileges: SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

SeDelegateSessionUserImpersonatePrivilege

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

<EventID>4672</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>12548</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-09-07T02:56:31.786372800Z" />

<EventRecordID>150741</EventRecordID>

<Correlation ActivityID="{61036ade-6526-0004-ef6a-03612665d501}" />

<Execution ProcessID="1132" ThreadID="1236" />

<Channel>Security</Channel>

<Computer>Chaser</Computer>

<Security />

</System>

<EventData>

<Data Name="SubjectUserSid">S-1-5-18</Data>

<Data Name="SubjectUserName">SYSTEM</Data>

<Data Name="SubjectDomainName">NT AUTHORITY</Data>

<Data Name="SubjectLogonId">0x3e7</Data>

<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

SeDelegateSessionUserImpersonatePrivilege</Data>

</EventData>

</Event>

:)

 

all games crash!

I suggest you run rthdribl > http://www.daionet.gr.jp/~masa/archives/rthdribl_1_2.zip
Increase the window size step by step and watch your vga temps permanently.
What happens?
If it crashes, run at stock speeds as suggested before and retry.

P.S.: When your system locks, does the display signal turn off after a time?
Stuttering sound or no sound at all when freezing?
What X1800XT model do you own exactly?

 

all games crash!

ive watch my temps and both the cpu and gpu are within normal ranges. when it freezes it simply freezes the image and stops the sound. i must reboot to get back to windows.

 

Audit mode

Hi Diane,

Windows boots into Windows Welcome Mode and Audit Mode. Windows Welcome Mode
is the first user experience while the Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit
Mode when upgrading or reinstalling Windows 10, the upgrade won’t progress.

Here's how to exit from Audit mode to reinstall Windows 10:

• Open the administrative or elevated Command Prompt. Type cmd in the
  Search field at the taskbar.
• Type the following command and press Enter key: sysprep /oobe /generalize
  DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing this command.
  
  
• Once the command IS successfully executed, you’ll be out of Audit Mode. Now you can re-try to upgrade to Windows 10 and it should work.

Let us know if the steps above worked for you.