Windows 10: Event ID 5061 Audit Failure after April Update.

Well like I said my PC decided to update to April update. *cry

It's funny last year with creators update Netflix and Hulu were giving me Audit Failure errors. It took Fall Creators to fix it. *Banghead

 

Okay so this morning I began getting these messages in my event viewer after my PC decided to update to April update.

They seem to happen after reboot and boot up.

Also trying to updated Defender definitions is kinda not happening. I even tried through cmd line and it said no updates were necessary, even though the definitions did update according to Microsoft.com

:)

 

event 5061, microsoft windows security auditing failure

event 5061, microsoft windows security auditing failure

Have no idea how to fix, but its provided by Microsoft and an unknown alogorithm name?

 

Security Audit Failure Event 5061 In Windows 10

I'm seeing these in my event log too. The failures happen four seconds before my video driver crashes (and restarts) while playing World of Warcraft. Could these two issues be related? I'm using onboard Intel HD 4600.

Audit Failure | Microsoft Windows security auditing.
| 5061 | System Integrity

Cryptographic operation.

Subject:

Security ID: SYSTEM

Account Name: XXXXXX$

Account Domain: WORKGROUP

Logon ID: 0x3E7

Cryptographic Parameters:

Provider Name: Microsoft Software Key Storage Provider

Algorithm Name: RSA

Key Name: 51a92691-66f1-280f-d0db-59fad4f73491

Key Type: User key.

Cryptographic Operation:

Operation: Open Key.

Return Code: 0x80090016

 

Also yes I do have an Nvidia GTX 970

 

I have the same Event ID 5061 in the Windows Logs/Security section of Event Viewer. It's an XBox Live certificate.
XBL Client Ipsec Issuing CA

For some reason this Event ID was moved to the Security section. Previously it would show as an Event ID 64 in the Application section of the Event Viewer.

You can verify this by running: certutil –store my
from the command prompt.

 

This is what I got by doing it

Serial Number: d49c11c6a8d97643a55b5eddd9a4e94a
Issuer: CN=XBL Client IPsec Issuing CA
NotBefore: 1/2/2018 10:20 AM
NotAfter: 1/3/2018 10:20 AM
Subject: CN=F9007479FC031D7A
Non-root Certificate
Cert Hash(sha1): cb1e5291b2e04c32b8651684f5f9fd4de010c775
Key Container = 11F88326-2132-4D64-9956-EB77B5003DC6
Unique container name: 2b1270ead2983daf54828e3f6773802a_bfd23135-ab1a-4702-9757-7ea9f71be682
Provider = Microsoft Software Key Storage Provider
Private key is NOT exportable
Encryption test passed
CertUtil: -store command completed successfully.



Should I reset the app then?

 

Exact same as mine.
Nothing really to do. If you use an XBox live game (or update it in any way) it will update the cert. If not, it's nothing to really worry about and won't cause any issues.

 

Funny enough I did try the uninstall and reinstall my Nvidia Drivers and still shows up so that can be ruled out then.

Edit- Decided to restore to my custom restore point I made a few hours ago before I tried "fixing this"

 

I am also getting this auditing error after upgrading to 1803, one after rebooting. I think I got one or two also a while after rebooting yesterday but today I only seen the one after rebooting or starting the laptop.

Searching the internet yesterday, I saw old posts from people mentioning Nvidia Driver but I dont think I have anything Nvidia in this laptop. Doing a search for Nvidia brings nothing. My error message is identical to the one posted by Redbatman, same number, mentions the certificate, etc.

Yesterday when I searched Google for the error and W10 1803, I found nothing. I am glad and thank you guys who reported getting 5061, now I know I am not alone. I was gonna report it in a few days if I didnt hear nothing about it. I dont use Xbox or play games and the error doesn't seem to affect the computer in anyway. I reckon this is one of those events we can safely ignore.

Bo

 

I guess you could try downloading a game off Windows store like fallout shelter for Xbox then launch it and after uninstall it and see if that fixes it.

 

If I remeber correctly ... You should be able to delete the expired certificate ... XBL Client IPsec Issuing CA ... and that should get rid of that error.

Right Click Start > Run > Type in mmc and hit enter
When the Console opens Click File > Add/Remove Snap In
On the left choose Certificates > Click Add
Select Computer Account > Click Next
Local Computer should already be selected > Click Finish > Click Ok
On the left > Certificates > Trusted Root Certification Authorities > Certificates
On the right > Look for the expired XBL Client IPsec Issuing CA by the date in Event Viewer> Right Click > Delete
Close mmc without saving when asked

Note: You may have more than one XBL Client IPsec Issuing CA (I currently have 2 that expire 9-20-2028) ... so make sure you deleted the right one.

 

Hmm sounds like it's best to wait and have Microsoft update the app?

 

I had same error its nvidia I have older 8800 card & all I did was download driver off nvidia site & reinstall the video driver & that error went away.

 

Like I said I tried that too and it didn't work for me. I had even uninstalled the driver and reinstalled it, and it still happened.