Windows 10: Event Viewer: hive history cleared Event ID 16 - large volume

Hi there,I have had about a dozen kernel-general events, Event ID 16 happen twice today - exactly 2 hours apart. They are large scale clearing of my hive history. The biggest one is this:The access history in hive \??\Volume{cd0dd4cb-59c5-4ca7-a93e-b5dc57f4bab3}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{D39CA7B8-A223-4C93-8B52-920F20D15CBE} was cleared updating 71186 keys and creating 8641 modified pages.and thisThe access history in hive \??\

:)

 

The access history in hive cleared

Hello. I had this in event viewer: Kernel-General16: "the access history in hive cleared Windowspowershell etc etc "

My Windows 10 is 1809 and 9900K stock.

In this time Battlefield 5 crashed without error in event log. Just exitted to desktop itself.

My question. That crash can be related to that Kernel-General16: "the access history in hive cleared Windowspowershell etc etc " or that doesnt matter?

 

Related to Event Viewer activities like EVENT ID 16, KERNEL GENERAL; and with a lots of EVENT 5379, Microsoft Windows Security Auditing....

So, my PC was in sleep mode with 55 percent battery. I resumed the Pc from sleep after some time and i noticed that the PC battery was drained to 5 percent. I thought there must be some problem, i checked event viewer and noticed some processing going on in my pc when it was in sleep. The Events were like this....

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\??\.............

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\SystemRoot\.............

* A lots of (thousands of) EVENT 5379, Microsoft Windows Security Auditing, Category: User Account Management

* EVENT 4799, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A security-enabled local group membership was enumerated.

* EVENT 4798, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A user's local group membership was enumerated.

* Some of LOGON and SPECIAL LOGON security events with EVENT ID 4624 and 4672 respectively.

What are these events? Are these events safe to occur or some malware kind of things?

 

The access history in hive cleared

Hello. I had this in event viewer: Kernel-General16: "the access history in hive cleared Windowspowershell etc etc "

My Windows 10 is 1809 and 9900K stock.

In this time Battlefield 5 crashed without error in event log. Just exitted to desktop itself.

My question. That crash can be related to that Kernel-General16: "the access history in hive cleared Windowspowershell etc etc " or that doesnt matter?