Windows 10: Excessive Security Log Events - Event ID 5379 - Windows 10

I have been experiencing Windows Application crashes on my 3 month old Windows 10 install. While troubleshooting, I noticed that there 50+ security events each minute in the Event Viewer under Windows Logs > Security.


Is this normal?


The majority are Audit Success Messages with the Event ID 5379. There are approximately 50 of these identical messages every minute. Thanks for any insight on this.


See below for typical Message:


Credential Manager credentials were read.


Subject:

Security ID: DESKTOP\*****

Account Name: *****

Account Domain: DESKTOP

Logon ID: 0x354889

Read Operation: Enumerate Credentials



This event occurs when a user performs a read operation on stored credentials in Credential Manager.

:)

 

Windows 10 workstation Security log filling with Event ID 4703

My Windows 10 workstation's Security Event Log is filled with informational Event ID 4703 (like 20/second).

It's an Audit Success on Authorization Policy Change category.

Pretty much all are about the javaw.exe process & SeSecurityPrivilege. But also a few of them list svchost.exe as the process & a whole list of privileges.

I can't find anything on the Net about event 4703.

Sometimes it lists the privilege as Disabled (as below), and some are Enabled. Back & forth, multiple events per second.

Does anyone have any idea what/why this is, or anyone else experiencing it?

Here are the details of the event (edited for privacy)...

Task Category: Authorization Policy Change

Level: Information

Keywords: Audit Success

User: N/A

Computer: xxxxx.yyyy.com

Description:

A user right was adjusted.

Subject:

Security ID: SYSTEM

Account Name: XXXXXX

Account Domain: YYYYYYYY

Logon ID: 0x3E7

Target Account:

Security ID: SYSTEM

Account Name: XXXXXXX

Account Domain: YYYYYYYYY

Logon ID: 0x3E7

Process Information:

Process ID: 0xb24

Process Name: C:\Windows\SysWOW64\ContegoSPOP\jre1.7.0_65\bin\javaw.exe

Enabled Privileges:

-

Disabled Privileges:

SeSecurityPrivilege

 

Event ID 7036 not showing in Windows Event Log on Win10

It looks like 7036 event is missing from Windows desktop OS (starting from 8).
However you can monitor process termination:

1. Enable Audit Policy to audit process tracking:
   

1. Check for event 4689 in Security Event Log
   

Alternatively you may try this solution.

But in this case, you will get event 4546 not only when the service starts or stops, but whenever something is trying to access it (e.g. when Services applet is open).

 

Event viewer error with event id 10016

Hello,

Thank you for posting your query on Microsoft Community forum.

I understand that you are getting an error “DistributedCOM 10016” in the event viewer logs.

• Do you face any issues on the computer?
  
• Have you made any recent changes to the computer?

This problem may occur if either of the following conditions is true:

• A program with the class ID (CLSID) that appears in the message tries to start the COM component by using the DCOM infrastructure. However, the user does not have the required permissions to start the COM component.

• The Network Service account does not have the correct permissions.

Event logs are special files that record significant events on your computer, such as when a user logs on to the computer or when a program encounters an error. Whenever these types of events occur, Windows records the event in
an event log that you can read by using Event Viewer. Advanced users might find the details in event logs helpful when troubleshooting problems with Windows and other programs.

If you do not have any issues with app or any other program I would suggest you to ignore it.

Keep us posted if you face any issues related to Windows in future. We will be glad to help you.