Windows 10: Why is an Event ID generated for a user but not for a group?

Hello,I enabled Audit Policy through the following method:Open the Local Group Policy Editor gpedit.msc.Navigate to Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Object Access.Open the Audit File System policy and check "Success".Update Group Policy Settings:Run the command "gpupdate /force" in Command Prompt to apply the changes.Then I set the Audit policy for the folder and selected a group from the select a principal section. For the group, only ID 4663 is created and ID 4660 is not generated, but when I select a user instead of a group, both IDs

:)

 

Related to Event Viewer activities like EVENT ID 16, KERNEL GENERAL; and with a lots of EVENT 5379, Microsoft Windows Security Auditing....

So, my PC was in sleep mode with 55 percent battery. I resumed the Pc from sleep after some time and i noticed that the PC battery was drained to 5 percent. I thought there must be some problem, i checked event viewer and noticed some processing going on in my pc when it was in sleep. The Events were like this....

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\??\.............

* Two or Three EVENT ID 16, KERNEL GENERAL; Category None; Description: The access history in hive\SystemRoot\.............

* A lots of (thousands of) EVENT 5379, Microsoft Windows Security Auditing, Category: User Account Management

* EVENT 4799, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A security-enabled local group membership was enumerated.

* EVENT 4798, Microsoft Windows Security Auditing, Category: Security Group Management. Description: A user's local group membership was enumerated.

* Some of LOGON and SPECIAL LOGON security events with EVENT ID 4624 and 4672 respectively.

What are these events? Are these events safe to occur or some malware kind of things?

 

Windows 11 Event log filled with thousands of Http Service Events 111, 113, 114 and 117

Using Windows 11 up to date and and event viewer is filled with the following events:

• Event 111, HttpService
  

Create URL group 0xFE0000022000000D. Status 0x0. Process Id 0x11BC Executable path \Device\HarddiskVolume3\Windows\System32\svchost.exe, User LOCAL SERVICE

• Event 113, HttpService
  Attempted to add URL (http://*:5357/c28dbf24-636b-4a58-9b7f-23bece36472a/) to URL group (0xFE0000022000000D). Status: 0x0. Process Id 0x11BC Executable path \Device\HarddiskVolume3\Windows\System32\svchost.exe, User LOCAL SERVICE
  

• Event 114, HttpService
  Removed URL (http://*:5357/c28dbf24-636b-4a58-9b7f-23bece36472a/) from URL group (0xFE0000022000000D). Process Id 0x11BC Executable path \Device\HarddiskVolume3\Windows\System32\svchost.exe, User LOCAL SERVICE
  

• Event 117, HttpService
  

Delete URL group 0xFE0000022000000D. Status 0x0. Process Id 0x11BC Executable path \Device\HarddiskVolume3\Windows\System32\svchost.exe, User LOCAL SERVICE

These seem to repeat every two or seconds, causing event viewer to be absolutely flooded with thousands of requests.

 

generic roaming event id 3

I get 62 errors daily generic roaming event id 3. I can not find a fix