Windows 10: Event ID 5061

Alright so both today and on June 23 I had gotten these audit failures that go like this.

Cryptographic operation.Subject: Security ID: DESKTOP-7V82FOC\Owner Account Name: Owner Account Domain: DESKTOP-7V82FOC Logon ID: 0x3DB3FCryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: D530ECA9-FF5A-4A6A-AAB3-6EC1870F2CC3 Key Type: User key.Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016

Cryptographic operation.Subject: Security ID: DESKTOP-7V82FOC\Owner Account Name: Owner Account Domain: DESKTOP-7V82FOC Logon ID: 0x3B5ECCryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: D530ECA9-FF5A-4A6A-AAB3-6EC1870F2CC3 Key Type: User key.Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016

Cryptographic operation.Subject: Security ID: LOCAL SERVICE Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3E5Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: User key.Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016

Cryptographic operation.Subject: Security ID: LOCAL SERVICE Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3E5Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: b872d2398f71ed94 Key Type: User key.Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016

Thing is that I don't believe these are related to my older posts about Netflix and Hulu since I have uninstalled them from my computer. Any ideas? Should I be worried?

:)

 

EVENT ID 5061 Microsoft Windows Security auditing

Thanks for your reply Kumar, the issue already solved. Just delete the NVIDIA 3D Graphic Driver. But I had another issue that I hope you can help. Since I updated to the anniversary build, each time I startup the computer, there is an event error 10016 in
the Event Viewer. There is no issue with the performance of the OS or any error message and any lack of performance. This happened on all my 3 computers :

Log Name: System

Source: Microsoft-Windows-DistributedCOM

Date: 8/12/2016 7:23:17 AM

Event ID: 10016

Task Category: None

Level: Error

Keywords: Classic

User: SYSTEM

Computer: Vincent

Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

<EventID Qualifiers="0">10016</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2016-08-11T23:23:17.801163800Z" />

<EventRecordID>2780</EventRecordID>

<Correlation />

<Execution ProcessID="968" ThreadID="6256" />

<Channel>System</Channel>

<Computer>Vincent</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="param1">application-specific</Data>

<Data Name="param2">Local</Data>

<Data Name="param3">Activation</Data>

<Data Name="param4">{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}</Data>

<Data Name="param5">{F72671A9-012C-4725-9D2F-2A4D32D65169}</Data>

<Data Name="param6">NT AUTHORITY</Data>

<Data Name="param7">SYSTEM</Data>

<Data Name="param8">S-1-5-18</Data>

<Data Name="param9">LocalHost (Using LRPC)</Data>

<Data Name="param10">Unavailable</Data>

<Data Name="param11">Unavailable</Data>

</EventData>

</Event>

System

- Provider

[ Name] Microsoft-Windows-DistributedCOM

[ Guid] {1B562E86-B7AA-4131-BADC-B6F3A001407E}

[ EventSourceName] DCOM



- EventID 10016

[ Qualifiers] 0



Version 0



Level 2



Task 0



Opcode 0



Keywords 0x8080000000000000



- TimeCreated

[ SystemTime] 2016-08-11T23:23:17.801163800Z



EventRecordID 2780



Correlation



- Execution

[ ProcessID] 968

[ ThreadID] 6256



Channel System



Computer Vincent



- Security

[ UserID] S-1-5-18



- EventData

param1 application-specific

param2 Local

param3 Activation

param4 {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

param5 {F72671A9-012C-4725-9D2F-2A4D32D65169}

param6 NT AUTHORITY

param7 SYSTEM

param8 S-1-5-18

param9 LocalHost (Using LRPC)

param10 Unavailable

param11 Unavailable

 

event 5061, microsoft windows security auditing failure

event 5061, microsoft windows security auditing failure

Have no idea how to fix, but its provided by Microsoft and an unknown alogorithm name?

 

According to this: Event Viewer -- Audit Failure 5061 - Windows 10 Forums
It says that it's your Nvidia card. Uninstall it. Download the Nvidia drivers from the company's website and install it. See if that fixes it.

 

Haleluja!!!! I am not the only one! The weird thing is, in my case it also started last week. A 'one shot', never happened again. I even went so far to restore an image and another image of a month ago. Same error. Indeed it does remind me of NVIDIA driver-s*** too. HOWEVER, in this particular pc is no NVIDIA card anymore. It broke down about a year ago and since I am not really a gamer anyway I just use the CPU-GPU since then. Of course I uninstalled the NVIDIA-driver. Completely, as far as I know. Never saw this event id since I removed the card until this week.

I was just about to post my question here too. Actually, what I like to know is: what does such an 'audit fail' in plain English actually MEAN? Is it something disastrous, or just a little nothing? If it would be repetitive AND it would have a clear subscription, I would know what is going on. But not like this.


greetings!

 

Evidence from my logs (to make it complete):
Cryptografische bewerking.


Onderwerp:
Beveiligings-id: LOCAL SERVICE
Accountnaam: LOCAL SERVICE
Accountdomein: NT AUTHORITY
Aanmeldings-id: 0x3E5


Cryptografieparameters:
Naam provider: Microsoft Software Key Storage Provider
Naam algoritme: UNKNOWN
Sleutelnaam: Microsoft Connected Devices Platform device certificate
Sleuteltype: Gebruikerssleutel.


Cryptografische bewerking:
Bewerking: Sleutel openen.
Retourcode: 0x80090016

 

I'am using the official Nvidia drivers though. But a few months back Microsoft did forceful install their Nvidia Driver on my computer, But I have since installed newer drivers. Each driver Install I do, I usually clean install it.