Windows 10: What these audits logs in event viewer?

My audit logs seems to be all turned off:





I would like some explanation on these why am I seeing "logon" events if they are turned off?





Can we turn these on / off and how?



PS: I understand turning these off are probably idea, but since I am researching under security so I would I like to do some tests.

:)

 

Unexpected Audit Failure in Event Viewer

I did make some progress in that I can disable the Audit Failure from being logged with the Event Viewer.

Go to Command Promp (Admin) and enter:

auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable

Caveat: Someone posted that the Audit Failure will likely return the next day.

Plus this is tantamount to replacing a fuse without fixing the underlying problem which is causing the fuse to blow.

Still hoping an Event Viewer / "Filtering Platform Connection" guru will chime in.

 

Error in Event Viewer

Hi,



Thank you for writing to Microsoft Community Forums.



As you have mentioned, you have performed a repair installation on the computer and you see Event 508, 510 and 533 in Event Viewer.



I would like to inform that if you see any critical error in Event Viewer, please share the event logs with us to help you with the appropriate troubleshooting steps. Please follow the steps mentioned below to share the event logs:

1. Press Windows + X from the keyboard, select
   Event Viewer.
   
2. Expand Windows Logs from the left pane and select
   Applications.
   
3. Click Filter Current Log from extreme right pane. Then in the new windows check the box beside
   Error and click OK.
   
4. Now, look for a critical Error in the list and note down the message/information from the
   General Tab in the lower section.
   

Please reply with the status of the issue, we will be glad to help you further.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

Security Event Log flooded with 4656 Events

We are having issues with our Security event log within Event Viewer. It is my understanding when you perform Object Access auditing and enable it within Group Policy, you still need to enable auditing on the Objects (to be audited) themselves. We just enabled
Object Access auditing and are already seeing Handle Manipulation events (i.e. event id 4656) flooding our Security log even though we have not configured auditing at the file level for ANY of the files in question.
A lot of forums mention disabling Audit File System and Audit Handle Manipulation events to ensure the 4656 events do not flood the Security log; however, we want to be able to see these events for the files that we configure auditing for (at the
file level), but not for any other files which were not configured for auditing at the file level.
We do not have Global Object Access Auditing configured.