Windows 10: Credentials Manager credentials were read multiple repeated attempts Event ID 5379

Still having issues with Event ID 5379 and multiple other ones. Also "Special privileges assigned to new logon" Event ID 4672.Accompanied by the following symptoms:Complete lock up of my I/O, mouse, keyboard, and the "USB disconnected" sound.I can review Event Viewer and I find a ton of these events piling up.I followed most of M.GalipSEV's suggestion to edit Local Policy, short of 'protecting all' network connections via Defender; that's overkill I think, all things considered. Most of the 'events' seem to have gone away, but I am not sure this is simply masking whe

:)

 

Excessive Security Log Events - Event ID 5379 - Windows 10

i had ex[eriences like that last night - my laptop so slowly

 

Windows Credentials

My problem reoccurred quickly, but I had no time to do anything about it and had, thus, nothing to post here.

Yesterday, I quickly looked in Event Viewer when there was a delay, and in Windows Logs > Security, I found this at the exact right time:

Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management

Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 5379 User Account Management
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 9/3/2021 5:09:49 PM Microsoft Windows security auditing. 4624 Logon
------------------------------------------------------------------

In one of the User Account Management, tab General, I found this:

For " User Account Management", it says, under tab "General":

Credential Manager credentials were read.

Subject:
Security ID: SYSTEM
Account Name: DESKTOP-JNCGSP4$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Read Operation: Enumerate Credentials

This event occurs when a user performs a read operation on stored credentials in Credential Manager.

=================================================
In Services, I disabled "Credential Manager", hoping it would solve my problem (and it is still disabled), but right after a delay today, I found basically the same information as above in Windows Log > Security, but also this:

An account was successfully logged on.

Subject:
Security ID: SYSTEM
Account Name: DESKTOP-JNCGSP4$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x3d8
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

--------------------------------

I know, this is a lot, but if you are familiar with it, perhaps it is not so bad.

I am not entirely sure i do not need the Credential stuff, but it would be great to be able to totally turn it off to check if it is it that slows opening files, folders and apps.

 

Windows Network Credentials

Hi Keith,

We suggest that you disable Credential Manager before mapping your Drives. Please follow these steps to disable Credential Manager:

• In the search box type “Services”
• Right click on “Services” and select “Run as Administrator”
• In the Services Window, look for Credential Manager Service and click “Stop”.
• Restart the computer and go back the Credential Manager Service and set it to “Automatic”.
• Restart the computer again.

Please keep us updated if you were able to map your drives.