Windows 10: Event Viewer Audit Failures for SeTcbPrivilege

Hello,


We are getting many Security Audit Failures in Event Viewer while livestreaming our church services. We notice it only does this on the Windows 10 Pro box not the Windows 10 Home. "Event 4673 A privileged service was called. Privileges: SeTcbPrivilege. Process Name: C:\Program Files\Livestream Studio\Livestream Studio Core.exe". Please help. This is causing problems for our Livestreaming.


-Andrew G. IT Director Forever Praise Ministries

:)

 

Unexpected Audit Failure in Event Viewer

I did make some progress in that I can disable the Audit Failure from being logged with the Event Viewer.

Go to Command Promp (Admin) and enter:

auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable

Caveat: Someone posted that the Audit Failure will likely return the next day.

Plus this is tantamount to replacing a fuse without fixing the underlying problem which is causing the fuse to blow.

Still hoping an Event Viewer / "Filtering Platform Connection" guru will chime in.

 

Unexpected Audit Failure in Event Viewer

Even with years of experience with Windows operating systems I am in the unenviable position of trying to diagnose an Audit Failure in the Event Viewer for Windows 10 on my Toshiba laptop that just reared its ugly head recently.

It is perhaps noteworthy that I am not seeing the same Audit Failure on my Dell desktop. Moreover "Filtering Platform Connection" never appears. This despite the fact both computers have the same (non-hardware specific) software installed and both are
connected problem free to my home network and printer.

Anyone know what causes (or triggers) the Security Task Category called Filtering Platform Connection?

Every occurrence results in an Audit Failure as shown below.

While some may want to focus on what is causing the Filtering Platform Connection failure to occur --
I am focusing instead on trying to figure out why I am getting the "Filtering Platform Connection" at all -- since it never appears on my desktop. But I've been wrong before.

Perhaps the task ""Filtering Platform Connection" only appears in the Event Viewer if there is an Audit Failure.

 

Audit failures every reboot - Event 5061 - Cryptographic operation.

Before I upgrade my 10 to the Spring version, I did some more digging.

I looked at the sequence of Audit Successes before and after each Audit Failure - maybe they're related? Maybe the steps mean something? In the link below, I have pasted the "General" subwindows for the Event Viewer events closely preceding, including and following each of the two Audit Failures in my most recent bootup.

There seems to be some kind of pattern of the machine looking at the key, DELETING it, then looking for it again, then throwing the AUDIT FAILURE - maybe because it just deleted the key and the key isn't there any more - and then re-creating the key. Is the AUDIT FAILURE just the good result of a test that the key was successfully deleted?

But WHY is the machine doing this? Why delete and recreate? What's really going on?

Here's the link to the Word Online document in which I've pasted both Event Viewer sequences:
<THIS LINK>

Any thoughts? (And am I interpreting the events correctly anyway?)