Windows 10: Event ID 4798

When computer goes into screen saver mode there are repeating sounds of devices loading and unloading. Event viewer shows thousands of event ID # 4798 over a 7 day period during which time screen saver is only active maybe 10 hours during that time. Event properties are as follows, please advise.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 1/8/2019 9:58:15 AM

Event ID: 4798

Task Category: User Account Management

Level: Information

Keywords: Audit Success

User: N/A

Computer: DESKTOP-OMFQNRD

Description:

A user's local group membership was enumerated.



Subject:

Security ID: DESKTOP-OMFQNRD\HPUser

Account Name: HPUser

Account Domain: DESKTOP-OMFQNRD

Logon ID: 0x36CF3A



User:

Security ID: DESKTOP-OMFQNRD\HPUser

Account Name: HPUser

Account Domain: DESKTOP-OMFQNRD



Process Information:

Process ID: 0x2860

Process Name: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

<EventID>4798</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>13824</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-01-08T14:58:15.125691500Z" />

<EventRecordID>86634</EventRecordID>

<Correlation ActivityID="{F31ED8AE-A699-0003-FBD8-1EF399A6D401}" />

<Execution ProcessID="788" ThreadID="8112" />

<Channel>Security</Channel>

<Computer>DESKTOP-OMFQNRD</Computer>

<Security />

</System>

<EventData>

<Data Name="TargetUserName">HPUser</Data>

<Data Name="TargetDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="TargetSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserSid">S-1-5-21-614283783-588511942-4173294447-1001</Data>

<Data Name="SubjectUserName">HPUser</Data>

<Data Name="SubjectDomainName">DESKTOP-OMFQNRD</Data>

<Data Name="SubjectLogonId">0x36cf3a</Data>

<Data Name="CallerProcessId">0x2860</Data>

<Data Name="CallerProcessName">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>

</EventData>

</Event>

:)

 

event id 10016

Hi Steven,

Go through this
forum post and follow the troubleshooting steps listed.

Let us know how it goes.

Regards.

 

computer failed to boot - disk error event id 153 + 98


Hi, suggest you try Hard Disk Sentinel (trial) - gives a great quick analysis (SSDs too).

Please post the results.

Event ID 153:
This event may be an indication that the specified drive may be failing soon. This is especially true if the event is recorded regularly. The first step is to run the maintenance utilities related to hard drives, starting with CHKDSK and the utilities available from the manufacturer for that specific brand.

Event ID 98:
Event ID: 98

 

Event ID 10016

Solved Numerous event id 10016 errors win 8 pro 64 bit

Here is the basic outline ...

1. Search the registry for the CLSID
2. Make note of the Default Value, which is the name (ex. ShellExperienceHost, RuntimeBroker) you're going to look for in DCOM
3. Change the Owner to Administrators
4. Give Administrators Full Control
5. Repeat steps 1-4 for the APPID
6. WinKey + s > type in component services > click on Component Services in list
7. Component Services > Computers > My Computer > DCOM Config
8. Change the View to Details
9. Find the name from step 2 (ex. ShellExperienceHost, RuntimeBroker)
10. Right Click on the Name > Properties
11. Select the Security Tab
12. Launch & Activation Permissions > Click Edit
13. Look for the offending user from the 10016 (ex. System, Local Service) and make sure it has the activation requested (ex. Local Activation). If the offending user does NOT exist, you have to add it and give it Local Launch and Local Activation
14. Click Apply
15. Close DCOM and Regedit
16. Reboot PC

Note: Make sure you understand the steps before doing them