Windows 10: Related to Operation Code in Event ID 5061 - Crptopgrahic operation

Log Name: SecuritySource: Microsoft-Windows-Security-AuditingDate: 2023-11-18 12:45:30Event ID: 5061Task Category: System IntegrityLevel: InformationKeywords: Audit SuccessUser: N/AComputer: SERVER01.domain.localEvent DescriptionA cryptographic operation was performed.Subject:Security ID: SYSTEMAccount Name: SERVER01$Account Domain: DOMAINLogon ID: 0x3E7Cryptographic Parametersrovider Name: Microsoft Software Key Storage ProviderAlgorithm Name: RSAKey Name: MyEncryptionKeyKey Type: Machine keyOperation:Operation: Key ImportOperation Code: 2101Return Code:Return Code: 0x0Consider the above sa

:)

 

Event ID 5061

So another user reported the same issue on Windows ten forum.

"I have the same Event ID 5061 in the Windows Logs/Security section of Event Viewer. It's an XBox Live certificate.

XBL Client Ipsec Issuing CA

For some reason this Event ID was moved to the Security section. Previously it would show as an Event ID 64 in the Application section of the Event Viewer.

You can verify this by running: certutil –store my

from the command prompt."

https://www.tenforums.com/general-support/109107-event-id-5061-audit-failure-after-april-update.html

 

Audit failures every reboot - Event 5061 - Cryptographic operation.

I did some more digging.

On reboot just now, there were three Audit Failures, Event 5061, for Cryptographic operation, all noting Process ID 888, which is lsass.exe, Local Security Authority Process
So I right-clicked on lsass.exe and looked at its related services, and they are:
Keylso - CNG Key Isolation - running
SamSs - Security Account Manager - running
VaultSvc - Credential Manager - running
Any ideas what this is, or how to fix?

 

Audit failures every reboot - Event 5061 - Cryptographic operation.

fdegrove - sorry, no luck. Disabled all three, rebooted and got again two Audit Failures.
(By the way, my plain old Dell Optiplex PC never had a smart card reader as far as I know.)
But that was a great idea.
Did you see my third post in this thread, at Audit failures every reboot - Event 5061 - Cryptographic operation. ?

EDIT - Am I missing a Certificate with the name "Microsoft Connected Devices Platform"? That's indicated as "Key name" in the eventvwr data.