Windows 10: Windows Security Audits to User Account Management are crashing applications

Have been having this for the last month, and went through both a recovery and then 2 days ago, a fresh install on a re-formatted drive with an iso image. Getting both application crashes and hangs, and reported BSODs via the event viewer - have followed threads on this posted previously in this forum without any luck. Have crashes of applications every half hour or so. I'm knowlegdable, but don't know the ins and out of whether the security logon 5 via services.exe and the following 120 events within the next 1-2 seconds to enumerate credentials under User Account Management could be l

:)

 

windows 8.1 is executing winsat.exe automatically even though its disabled in task scheduler.

windows 8.1 is executing winsat.exe automatically even though its disabled in task scheduler. When Checking event viewer security logs it tells me someone logged into my computer even though I was already logged in but idle and executed winsat.exe. Is this normal or is someone logging into my computer remotely? I have multiple logins and special logins in my Log and logoffs when i did not logoff.

Audit Success 6/29/2014 5:29:03 PM Microsoft Windows security auditing. 4616 Security State Change
Audit Success 6/29/2014 5:03:25 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 5:03:25 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:13:16 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 2:13:16 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:03:54 PM Microsoft Windows security auditing. 4634 Logoff
Audit Success 6/29/2014 2:03:54 PM Microsoft Windows security auditing. 4634 Logoff
Audit Success 6/29/2014 2:00:18 PM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 2:00:18 PM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 2:00:18 PM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 2:00:18 PM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 2:00:15 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 2:00:15 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:00:15 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:00:15 PM Microsoft Windows security auditing. 4648 Logon
Audit Success 6/29/2014 2:00:07 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 2:00:07 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 2:00:07 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:00:07 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 2:00:07 PM Microsoft Windows security auditing. 4648 Logon
Audit Success 6/29/2014 2:00:06 PM Microsoft Windows security auditing. 4647 Logoff
Audit Success 6/29/2014 12:55:51 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 12:55:51 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 12:43:02 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 12:43:02 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 12:43:02 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 12:43:02 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 12:16:13 PM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 12:16:13 PM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:20:53 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:20:53 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:19:04 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:19:04 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:09:04 AM Microsoft Windows security auditing. 6406 Other System Events
Audit Success 6/29/2014 11:07:59 AM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 11:07:59 AM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 11:07:59 AM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 11:07:59 AM Microsoft Windows security auditing. 4797 User Account Management
Audit Success 6/29/2014 11:07:57 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:57 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:56 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:56 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:56 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:56 AM Microsoft Windows security auditing. 4648 Logon
Audit Success 6/29/2014 11:07:50 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:50 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:48 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:48 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:45 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:45 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:45 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:44 AM Microsoft Windows security auditing. 5024 Other System Events
Audit Success 6/29/2014 11:07:44 AM Microsoft Windows security auditing. 5033 Other System Events
Audit Success 6/29/2014 11:07:44 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:44 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4648 Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4672 Special Logon
Audit Success 6/29/2014 11:07:42 AM Microsoft Windows security auditing. 4624 Logon

 

Customize Windows 10 Image in Audit Mode with Sysprep  


Hi,

I have the same Problem like CanadianGooses with the Search-Bar using the LTSB-Release and the audit-mode.

(Windows 10 Image - Customize in Audit Mode with Sysprep - Page 32 - Windows 10 Forums)

But only, if the image is deployed as a part of a iso-file. How do you deploy your wim-file? Has anyone found a solution?


Thanks und greetings from Germany - .

 

Customize Windows 10 Image in Audit Mode with Sysprep  


Dear Kari,

I'm supporting an enterprise deployment and we're using Windows 10 Enterprise 2015 LTSB (which reports as "Version 10.0 (Build 10240)" in 'winver'). I've performed the following steps:

• Clean install
• Audit mode
• Customisation
  • Drivers
  • Software
  • No updates
  • Kari's quickaccess cleaner .bat
• sysprep (generalize, oobe, unattend.xml specifying copyprofile=true)
• deploy image

This is fine, and Windows Search works for all created user accounts...

...UNLESS Windows Update is run. As soon as it is, it installs Security Update KB3135174, and any subsequently created user accounts receive a broken search. If KB3135174 is removed, new user accounts get a working search, and existing accounts that had a broken search start working. If it's reinstalled, new user accounts get a broken search again.

Do I have any options, or do I have to just give up on the customised default profile?