Windows 10: many "A user's local group membership was enumerated" events

Whenever I put my Surface Book to sleep it keeps beeping. I see hundreds of "Audit Sucess" - A user's local group membership was enumerated. Event 4798. My computer is not in contact with a server. It only on my home wifi. My updates are current. I have run every diagnostic that I can find online from the command prompt. scannow, DISM, etc. I have downloaded and run the Surface Diagnostic Tool kit.

:)

 

Show Local users and Groups


Hello Frank, and welcome to Ten Forums.

If you have the Windows 10 Home edition, then it will not have Local Users and Groups (lusrmgr.msc) included in it. It's only available in the Pro and Enterprise editions instead.

If you like, you could use step 3 in OPTION THREE of the tutorial below list users in a group.

https://www.tenforums.com/tutorials/6...a.html#option4

 

Event Viewer Question

Hi,

I've been noticing that every time I log on, the following event happens:

Event #: 4798

A user's local group membership was enumerated.

Subject:

Security ID: SYSTEM

Account Domain: WORK GROUP

Logon ID: 0x3E7

User:

Security ID: (Name of my PC)/Guest

Account Name: Guest

Before that event was this one:

Event 4799:

A security-enabled local group membership was enumerated.

Security ID: SYSTEM

Account Name: Name of my PC with a $ sign at the end

Account Domain: WORKGROUP

Logon ID: 0x3E7

Group:

Security ID: BUILTIN\GUESTS

Group Name: Guests

Group Domain: Builtin

Process Information:

Process ID: 0x7b8

Process Name: C:\Program Files\MY INTERNET SECURITY PROGRAM

Would sure appreciate some help in answering why there are guests in these events.

Thanks very much,

M

* Moved from Virus & Malware

 

Related to Event Viewer activities like EVENT ID 16, KERNEL GENERAL; and with a lots of EVENT 5379, Microsoft Windows Security Auditing....

So, my PC was in sleep mode with 55 percent battery. I resumed the Pc from sleep after some time and i noticed that the PC battery was drained to 5 percent. I thought there must be some problem, i checked event viewer and noticed some processing going on in my pc when it was in sleep. The Events were like this....

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\??\.............

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\SystemRoot\.............

* A lots of (thousands of) EVENT 5379, Microsoft Windows Security Auditing, Category: User Account Management

* EVENT 4799, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A security-enabled local group membership was enumerated.

* EVENT 4798, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A user's local group membership was enumerated.

* Some of LOGON and SPECIAL LOGON security events with EVENT ID 4624 and 4672 respectively.

What are these events? Are these events safe to occur or some malware kind of things?