Windows 10: Disconnect device sound with event ID 4624 and 4798

Hello Everyone - this is my first post and was not sure which forum to use.

My issue is that starting 2-3 days ago, I'm hearing a "disconnect device" sound several times throughout the day.
I've Googled it and it shows up as an issue - from what I can tell, the alerts correspond to Event IDs 4624 and 4798 under the security tab in Event Viewer. There are also times when IDs 4799, 4904, and 4905 appear as well.

I saw some people have used the app USBLogView (USBDview), but I haven't tried that yet.
This only started happening after I installed "Carbonite" - a subscription that I transferred from my old PC with Win7 to my brand new PC with Win10 (which I purchased and set up 1/2/20) - coincidence?
I know I can go into the sound control panel and change the "device disconnect" sound to "none" - but I'd prefer to know what is causing this new issue.
Is it a cause for concern, or just another "one of those things".

I enjoy working on my computer and like to do routine troubleshooting, so any help/advice would be much appreciated.
I've attached 2 text files with the details of those Event IDs.
Thank you.
Version 1903 (x64)Event ID 4624.txtEvent ID 4672.txt

:)

 

Event ID 4798

Hi,

Thank you for writing to Microsoft Community Forums.

Do you have any external device connected to the computer permanently, apart from Mouse and Keyboard?

As per the event logs, I suggest you to close the Chrome application completely from the task manager and then perform Clean Boot on your computer to check with the issue.

Please refer this article to perform
Clean Boot.

NOTE: Performing a clean boot will start the computer with minimal set of drivers and programs, to determine whether a background program is causing the issue. Some of the Startup programs will not load after performing
a clean boot on the computer. However, that functionality will return when you reset the computer to start normally after finishing the troubleshooting.

Please refer this article to know more about

Event ID 4798.

Please reply with the status of the issue, we will be glad to help you further.

Regards,

Noor Azam S

Microsoft Community-Moderator

 

Event ID 4798

When computer goes into screen saver mode there are repeating sounds of devices loading and unloading. Event viewer shows thousands of event ID # 4798 over a 7 day period during which time screen saver is only active maybe 10 hours during that time.
Event properties are as follows, please advise.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 1/8/2019 9:58:15 AM

Event ID: 4798

Task Category: User Account Management

Level: Information

Keywords: Audit Success

User: N/A

Computer: DESKTOP-OMFQNRD

Description:

A user's local group membership was enumerated.



Subject:

Security ID:
DESKTOP-OMFQNRD\HPUser

Account Name:
HPUser

Account Domain:
DESKTOP-OMFQNRD

Logon ID:
0x36CF3A



User:

Security ID:
DESKTOP-OMFQNRD\HPUser

Account Name:
HPUser

Account Domain:
DESKTOP-OMFQNRD



Process Information:

Process ID:
0x2860

Process Name:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

<EventID>4798</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>13824</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-01-08T14:58:15.125691500Z" />

<EventRecordID>86634</EventRecordID>

<Correlation ActivityID="{F31ED8AE-A699-0003-FBD8-1EF399A6D401}" />

<Execution ProcessID="788" ThreadID="8112" />

<Channel>Security</Channel>

<Computer>DESKTOP-OMFQNRD</Computer>

<Security />

</System>

<EventData>

<Data Name="TargetUserName">HPUser</Data>

<Data Name="TargetDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="TargetSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserName">HPUser</Data>

<Data Name="SubjectDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="SubjectLogonId">0x36cf3a</Data>

<Data Name="CallerProcessId">0x2860</Data>

<Data Name="CallerProcessName">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>

</EventData>

</Event>

 

Event 4624 log deleted

Hi, BO,

I am an Independent Advisor and will assist you.

Event ID 4624

Identifies the account that requested the logon - NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information.

https://docs.microsoft.com/en-us/windows/securi...

Pat