Windows 10: hi, about code 6281 audit failure

hi, i've been seeing many audit failures on the even viewer and it looks very suspicious to me.

i want to find the ip address of that person who tried to connect to the user and i can't find it.

any help on how to it?

i'm no expert on WEF stuff.

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>6281</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreatedSystemTime="2019-02-13T15:43:20.130982800Z" />
<EventRecordID>3952</EventRecordID>
<Correlation/>
<Execution ProcessID="4" ThreadID="64" />
<Channel>Security</Channel>
<Computer>HackerU7-PC.blackparade.local</Computer>
<Security />
</System>

-<EventData>
<Data Name="param1">\Device\HarddiskVolume2\Windows\System32\l3codeca.acm</Data>
</EventData>

:)

 

Event ID 6281

Has anyone else seen Event ID 6281 errors appear as Security Audit Failures in their Event Viewer since upgrading to Windows 10? I have two PCs, one was upgrade to Windows 10 and the other was a clean install, that receive this error every time I watch
a video using the Netflix app.

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name: \Device\HarddiskVolume4\Windows\System32\winhttp.dll

I have run the sfc /scannow command and it comes back clean. I have also check the disk drives on both PCs and they report 100% healthy with no errors. Since Netflix works without any issue, I am assuming that this is another false error that Windows 10
is generating, but I have not seen any other posts on it.

 

Security Audit Failure Event 5061 In Windows 10

Hello,

A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.

The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.

Advanced Security Auditing FAQ

 

Creators Update brings Audit failures?

Okay so I have noticed that ever since I installed the Creators Update on Tuesday I have gotten Event ID 6281 which say the following.

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could
indicate a potential disk device error.File Name: \Device\HarddiskVolume2\Windows\System32\Windows.UI.dll

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could
indicate a potential disk device error.File Name: \Device\HarddiskVolume2\Windows\System32\WinMetadata\Windows.Graphics.winmd

Anyone else getting these? I feel a little worried cause the night before this happened I did get a sleep issues which led to a hard shutdown and chkdsk had to do some working. Though I did do some more
chkdsk checks after that and chkdsk comes back saying i'm good, I did make a topic about that on this forum too.

But yeah even after that I got no Audit Failure till I did the Creators Update

***Post moved by the moderator to the appropriate forum category.***