Windows 10: Excessive "Audit Success" log events for event ID 5061 and 5058

I'm getting these 2 event IDs logged every 5 seconds in my Security log on Windows 11 Pro.This seems excessive. Also unsure why this is happening like clockwork, regardless what I'm doing on my laptop.Anyone else seeing this? Wondering whether I can/need to update my Audit Policy. Thoughts?

:)

 

Event ID 5061

So another user reported the same issue on Windows ten forum.

"I have the same Event ID 5061 in the Windows Logs/Security section of Event Viewer. It's an XBox Live certificate.

XBL Client Ipsec Issuing CA

For some reason this Event ID was moved to the Security section. Previously it would show as an Event ID 64 in the Application section of the Event Viewer.

You can verify this by running: certutil –store my

from the command prompt."

https://www.tenforums.com/general-support/109107-event-id-5061-audit-failure-after-april-update.html

 

Audit sucess Audit faliure code 5058 and code 5061

If your event log looks like mine you have audit success followed by audit failure with this string 51a92691-66f1-280f-d0db-59fad4f73491 for both the success and the failure. The success is 5058 the failure is 5061. I used the string in using find then f3
for find next.

In the success it says algorithm unknown in the failure is says algorithm RSA if that help anything.

I use regedit and found two entries for this string. first HKEY local Machine system control set001 cryptography ngc keytranspoet key perdevicekey keytranspot key d2bf6f-------------

Second in still Hkey Local Machine system now in courrentcontrolset control cryptography ngc same as above.

Now if the audit goes in order than the first I would think would be the 5058 and a split second later 5061 would be the second entry.

I haven't done anything yet as I always put a lot of thought when working in regedit. So I'm posting this as and idea and for discussion. I think deleting the second string would stop this and also error 131 which on my Acer Laptop Asprire 7741z4433 is common.

Likely someone knows more than me and can say both are needed or not.

 

Weird events: 5058 5059 and 5061

Hello, today I saw those event ids in the log viewer, it happened in a moment I was sleeping.

5058

5059

5061

I see these have to do with windows credentials, with the backup/transfer/storage of them, but not sure exactly what happened.

The PID was related to Xbox Live, but I was sleeping at the time and also never used any Windows app related to Xbox or gaming at all.

Does this mean my computer might be compromised? If so, is there any way to remediate it/protect myself further?

How to investigate what happened and how should I proceed overall? thanks