Windows 10: Event Viewer Audit Failures for SeTcbPrivilege

Discus and support Event Viewer Audit Failures for SeTcbPrivilege in AntiVirus, Firewalls and System Security to solve the problem; Hello, We are getting many Security Audit Failures in Event Viewer while livestreaming our church services. We notice it only does this on the... Discussion in 'AntiVirus, Firewalls and System Security' started by IT-DIR, Jan 25, 2020.

  1. IT-DIR Win User

    Event Viewer Audit Failures for SeTcbPrivilege


    Hello,


    We are getting many Security Audit Failures in Event Viewer while livestreaming our church services. We notice it only does this on the Windows 10 Pro box not the Windows 10 Home. "Event 4673 A privileged service was called. Privileges: SeTcbPrivilege. Process Name: C:\Program Files\Livestream Studio\Livestream Studio Core.exe". Please help. This is causing problems for our Livestreaming.


    -Andrew G. IT Director Forever Praise Ministries

    :)
     
    IT-DIR, Jan 25, 2020
    #1

  2. Unexpected Audit Failure in Event Viewer

    I did make some progress in that I can disable the Audit Failure from being logged with the Event Viewer.

    Go to Command Promp (Admin) and enter:

    auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable

    Caveat: Someone posted that the Audit Failure will likely return the next day.

    Plus this is tantamount to replacing a fuse without fixing the underlying problem which is causing the fuse to blow.

    Still hoping an Event Viewer / "Filtering Platform Connection" guru will chime in.
     
    sdmike1974, Jan 25, 2020
    #2
  3. Unexpected Audit Failure in Event Viewer

    Even with years of experience with Windows operating systems I am in the unenviable position of trying to diagnose an Audit Failure in the Event Viewer for Windows 10 on my Toshiba laptop that just reared its ugly head recently.

    It is perhaps noteworthy that I am not seeing the same Audit Failure on my Dell desktop. Moreover "Filtering Platform Connection" never appears. This despite the fact both computers have the same (non-hardware specific) software installed and both are
    connected problem free to my home network and printer.


    Anyone know what causes (or triggers) the Security Task Category called Filtering Platform Connection?

    Every occurrence results in an Audit Failure as shown below.

    While some may want to focus on what is causing the Filtering Platform Connection failure to occur --
    I am focusing instead on trying to figure out why I am getting the "Filtering Platform Connection" at all -- since it never appears on my desktop. But I've been wrong before. Event Viewer Audit Failures for SeTcbPrivilege :)

    Perhaps the task ""Filtering Platform Connection" only appears in the Event Viewer if there is an Audit Failure.




    Event Viewer Audit Failures for SeTcbPrivilege c64b83b8-8700-414d-87e5-d2a10e5ed7c4?upload=true.jpg
     
    sdmike1974, Jan 25, 2020
    #3
  4. glnz Win User

    Event Viewer Audit Failures for SeTcbPrivilege

    Audit failures every reboot - Event 5061 - Cryptographic operation.

    Before I upgrade my 10 to the Spring version, I did some more digging.

    I looked at the sequence of Audit Successes before and after each Audit Failure - maybe they're related? Maybe the steps mean something? In the link below, I have pasted the "General" subwindows for the Event Viewer events closely preceding, including and following each of the two Audit Failures in my most recent bootup.

    There seems to be some kind of pattern of the machine looking at the key, DELETING it, then looking for it again, then throwing the AUDIT FAILURE - maybe because it just deleted the key and the key isn't there any more - and then re-creating the key. Is the AUDIT FAILURE just the good result of a test that the key was successfully deleted?

    But WHY is the machine doing this? Why delete and recreate? What's really going on?

    Here's the link to the Word Online document in which I've pasted both Event Viewer sequences:
    <THIS LINK>


    Any thoughts? (And am I interpreting the events correctly anyway?)
     
Thema:

Event Viewer Audit Failures for SeTcbPrivilege

Loading...
  1. Event Viewer Audit Failures for SeTcbPrivilege - Similar Threads - Event Viewer Audit

  2. event viewer

    in Windows 10 BSOD Crashes and Debugging
    event viewer: got problems something like administrative logs. https://answers.microsoft.com/en-us/windows/forum/all/event-viewer/a279ad53-b762-44fa-aae8-91b62f4f19d8
  3. Event Viewer

    in Windows 10 Network and Sharing
    Event Viewer: Hello. I am trying to run the Microsoft Event Viewer (Windows + R key; eventvwr; press enter). The message I get is: Error Log Service Unavailable. Verify Service is running. How do I fix this? Shouldn't the event viewer be running all the time? Thanks!...
  4. Audit failures every reboot - Event 5061 - Cryptographic operation.

    in Windows 10 Support
    Audit failures every reboot - Event 5061 - Cryptographic operation.: Audit failures every reboot - Event 5061 - Cryptographic operation. Win 10 Pro 64-bit version 1803. ‎4/‎28/‎2019 Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to...
  5. Unexpected Audit Failure in Event Viewer

    in Windows 10 BSOD Crashes and Debugging
    Unexpected Audit Failure in Event Viewer: Even with years of experience with Windows operating systems I am in the unenviable position of trying to diagnose an Audit Failure in the Event Viewer for Windows 10 on my Toshiba laptop that just reared its ugly head recently. It is perhaps noteworthy that I am not seeing...
  6. Audit Failure reports in Event Viewer

    in Windows 10 Performance & Maintenance
    Audit Failure reports in Event Viewer: Since the PC upgraded to Windows 10 version 1803 build 17134.191, the event log on start up repeatedly gives the three different audit failures below. I have managed to clear all the other problems the event log has displayed but with these three I am at a lost as to the...
  7. Event ID 5061 Audit Failure after April Update.

    in Windows 10 Support
    Event ID 5061 Audit Failure after April Update.: Okay so this morning I began getting these messages in my event viewer after my PC decided to update to April update. They seem to happen after reboot and boot up. Also trying to updated Defender definitions is kinda not happening. I even tried through cmd line and it said...
  8. Audit Failure 5061

    in Windows 10 Support
    Audit Failure 5061: I keep getting this Audit failure 5061. Cryptographic operation. Subject: Security ID: SYSTEM Account Name: DOCOMO$ Account Domain: WORKGROUP Logon ID: 0x3E7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name:...
  9. Event ID 5061 Audit Failure after April Update.

    in Windows 10 Support
    Event ID 5061 Audit Failure after April Update.: Not surprised. Let MS fix it. I wonder if people who did a clean install have the issue? Since the certutil command says " Private key is NOT exportable " it may be an issue for those who updated? I myself updated. Well like I said my PC decided to update to April update....
  10. Event Viewer -- Audit Failure 5061

    in Windows 10 Performance & Maintenance
    Event Viewer -- Audit Failure 5061: I continue to get this event in the Event Log under Audit Failure. I never had in Windows 8.1 and it started after upgrading to 10. Does anyone have a clue about it? Cryptographic operation. Subject: Security ID: SYSTEM Account Name: xxxx Account Domain: xxxx...

Users found this page by searching for:

  1. setcbprivilege audit failures

    ,
  2. livestream event viewer failure setcbprivilege