Audit failure 5061 after logging in to Windows 10
8
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:ProgramDataMicrosoftCryptoSystemKeys
It says the key type is a user key.
Inside the 5061 Audit failure is the following information:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: WIN-SOA3U4S9MJA$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
The details tab contains
System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5061
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2015-09-27T21:28:17.888978900Z
EventRecordID 6545
- Correlation
[ ActivityID] {2E32FFFF-F96B-0003-D003-332E6BF9D001}
- Execution
[ ProcessID] 936
[ ThreadID] 408
Channel Security
Computer WIN-SOA3U4S9MJA
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName WIN-SOA3U4S9MJA$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
ProviderName Microsoft Software Key Storage Provider
AlgorithmName RSA
KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8
KeyType %%2500
Operation %%2480
ReturnCode 0x80090016
What is going on, and how do I fix it?
security windows-10 login event-log rsa
asked Sep 25 '15 at 4:45
hellyale
90214
|
show 10 more comments
8
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:ProgramDataMicrosoftCryptoSystemKeys
It says the key type is a user key.
Inside the 5061 Audit failure is the following information:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: WIN-SOA3U4S9MJA$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
The details tab contains
System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5061
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2015-09-27T21:28:17.888978900Z
EventRecordID 6545
- Correlation
[ ActivityID] {2E32FFFF-F96B-0003-D003-332E6BF9D001}
- Execution
[ ProcessID] 936
[ ThreadID] 408
Channel Security
Computer WIN-SOA3U4S9MJA
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName WIN-SOA3U4S9MJA$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
ProviderName Microsoft Software Key Storage Provider
AlgorithmName RSA
KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8
KeyType %%2500
Operation %%2480
ReturnCode 0x80090016
What is going on, and how do I fix it?
security windows-10 login event-log rsa
asked Sep 25 '15 at 4:45
hellyale
90214
In the error report from event viewer, is there a field calledKey Name:?
– DrZoo
Sep 25 '15 at 6:56
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58
|
show 10 more comments
8
8
8
1
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:ProgramDataMicrosoftCryptoSystemKeys
It says the key type is a user key.
Inside the 5061 Audit failure is the following information:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: WIN-SOA3U4S9MJA$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
The details tab contains
System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5061
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2015-09-27T21:28:17.888978900Z
EventRecordID 6545
- Correlation
[ ActivityID] {2E32FFFF-F96B-0003-D003-332E6BF9D001}
- Execution
[ ProcessID] 936
[ ThreadID] 408
Channel Security
Computer WIN-SOA3U4S9MJA
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName WIN-SOA3U4S9MJA$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
ProviderName Microsoft Software Key Storage Provider
AlgorithmName RSA
KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8
KeyType %%2500
Operation %%2480
ReturnCode 0x80090016
What is going on, and how do I fix it?
security windows-10 login event-log rsa
asked Sep 25 '15 at 4:45
hellyale
90214
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:ProgramDataMicrosoftCryptoSystemKeys
It says the key type is a user key.
Inside the 5061 Audit failure is the following information:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: WIN-SOA3U4S9MJA$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
The details tab contains
System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5061
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2015-09-27T21:28:17.888978900Z
EventRecordID 6545
- Correlation
[ ActivityID] {2E32FFFF-F96B-0003-D003-332E6BF9D001}
- Execution
[ ProcessID] 936
[ ThreadID] 408
Channel Security
Computer WIN-SOA3U4S9MJA
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName WIN-SOA3U4S9MJA$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
ProviderName Microsoft Software Key Storage Provider
AlgorithmName RSA
KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8
KeyType %%2500
Operation %%2480
ReturnCode 0x80090016
What is going on, and how do I fix it?
security windows-10 login event-log rsa
security windows-10 login event-log rsa
asked Sep 25 '15 at 4:45
hellyale
90214
asked Sep 25 '15 at 4:45
hellyale
90214
edited Sep 27 '15 at 21:35
asked Sep 25 '15 at 4:45
hellyale
90214
asked Sep 25 '15 at 4:45
hellyale
90214
asked Sep 25 '15 at 4:45
hellyale
90214
90214
In the error report from event viewer, is there a field calledKey Name:?
– DrZoo
Sep 25 '15 at 6:56
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58
|
show 10 more comments
In the error report from event viewer, is there a field calledKey Name:?
– DrZoo
Sep 25 '15 at 6:56
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58
In the error report from event viewer, is there a field called
Key Name:?– DrZoo
Sep 25 '15 at 6:56
In the error report from event viewer, is there a field called
Key Name:?– DrZoo
Sep 25 '15 at 6:56
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58
|
show 10 more comments
1 Answer
1
active
oldest
votes
0
In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.
Error is not generated in edge, firefox or chrome.
answered Nov 22 '15 at 7:49
David McGowan
425310
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f977892%2faudit-failure-5061-after-logging-in-to-windows-10%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.
Error is not generated in edge, firefox or chrome.
answered Nov 22 '15 at 7:49
David McGowan
425310
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
add a comment |
0
In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.
Error is not generated in edge, firefox or chrome.
answered Nov 22 '15 at 7:49
David McGowan
425310
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
add a comment |
0
0
0
In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.
Error is not generated in edge, firefox or chrome.
answered Nov 22 '15 at 7:49
David McGowan
425310
In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.
Error is not generated in edge, firefox or chrome.
answered Nov 22 '15 at 7:49
David McGowan
425310
answered Nov 22 '15 at 7:49
David McGowan
425310
answered Nov 22 '15 at 7:49
David McGowan
425310
answered Nov 22 '15 at 7:49
David McGowan
425310
425310
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
add a comment |
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome...
– hellyale
Nov 22 '15 at 16:10
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f977892%2faudit-failure-5061-after-logging-in-to-windows-10%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
In the error report from event viewer, is there a field called
Key Name:?– DrZoo
Sep 25 '15 at 6:56
Yes, I wasn't sure if I should post it since it happens with every login
– hellyale
Sep 25 '15 at 13:04
@DrZoo is it safe to post? If so I'll edit it in when I get home
– hellyale
Sep 25 '15 at 15:25
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge
– DrZoo
Sep 26 '15 at 15:05
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins.
– hellyale
Sep 26 '15 at 16:58