• Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    Home » Forums » AskWoody support » Windows » Windows 10 » Windows 10 versions – no longer supported » Windows 10 version 1803 – April 2018 Update » Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    Tags:

    Author
    Topic
    glnz
    AskWoody Plus
    April 29, 2019 at 2:21 am #1089597

     

    Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography.  So my Win 10 machine is insecure?  I have run sfc /scannow  and  Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck.  And I hardly even use my Win 10 machine – there are almost no apps on it yet.  My actual Win 10 build is 17134.706.

    I have posted about this in MS Technet at

    https://social.technet.microsoft.com/Forums/en-US/48425e2a-54c2-480d-8957-383415be2381/audit-failures-every-reboot-event-5061-cryptographic-operation-win-10-pro-64bit?forum=win10itprosetup

    Please go there for lots of detail and to let me know your thoughts (or come back here).

    Thanks.

     

    Reply | Quote
    Viewing 8 reply threads
    Author
    Replies
    • Alex5723
      AskWoody Plus
      April 29, 2019 at 5:31 am #1094231
      glnz wrote:

      Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography. So my Win 10 machine is insecure? I have run sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck. And I hardly even use my Win 10 machine – there are almost no apps on it yet. My actual Win 10 build is 17134.706.

      I have posted about this in MS Technet at

      https://social.technet.microsoft.com/Forums/en-US/48425e2a-54c2-480d-8957-383415be2381/audit-failures-every-reboot-event-5061-cryptographic-operation-win-10-pro-64bit?forum=win10itprosetup

      Please go there for lots of detail and to let me know your thoughts (or come back here).

      Thanks.

      It seems like GPU/NVidia driver problem

      https://answers.microsoft.com/en-us/windows/forum/all/security-audit-failure-event-5061-in-windows-10/6de3cdd6-cb0a-478b-aca6-2f36e2eb85f6

      Reply | Quote
      • glnz
        AskWoody Plus
        April 29, 2019 at 7:47 am #1097495

         

        Alex5723 – thanks.  But I don’t have a video card – not Nvidia and not anything else.  My graphics are built-in:  “Intel(R) HD Graphics”.  And I just tried to update its driver from Device Manager but I already have the latest.

        Also, I don’t have Xbox, I did not see XBL Client IPsec in the mmc certificate lists, and certutil -store my didn’t fix the problem.

        What do you think?

         

        Reply | Quote
    • Alex5723
      AskWoody Plus
      April 29, 2019 at 1:32 pm #1105213
      glnz wrote:

      Alex5723 – thanks. But I don’t have a video card – not Nvidia and not anything else. My graphics are built-in: “Intel(R) HD Graphics”. And I just tried to update its driver from Device Manager but I already have the latest.

      Also, I don’t have Xbox, I did not see XBL Client IPsec in the mmc certificate lists, and certutil -store my didn’t fix the problem.

      What do you think?

      Did you check “delete browsing history on exit” in internet explorer 11?
      If so, uncheck and test the system.

      Reply | Quote
    • glnz
      AskWoody Plus
      April 29, 2019 at 2:05 pm #1105953

      Alex –

      Where exactly in Win 10 Pro version 1803 will I find “delete browsing history on exit” in internet explorer 11?

      Just looked and did NOT find exactly that.

      Thanks.

      Reply | Quote
    • Alex5723
      AskWoody Plus
      April 29, 2019 at 2:55 pm #1107011
      glnz wrote:

      “delete browsing history on exit” in internet explorer 11

      https://www.computerhope.com/issues/ch001120.htm

      Reply | Quote
      • glnz
        AskWoody Plus
        May 2, 2019 at 3:34 pm #1215221

        Alex – thanks for suggestion, but setting IE to delete browsing history on exit does not help.  I’m still getting the Audit Failures on reboots.

        I did some more digging.

        On one of today’s reboots, there were three Audit Failures, Event 5061, for Cryptographic operation, all noting Process ID 888, which was lsass.exe, Local Security Authority Process

        So I right-clicked on lsass.exe and looked at its related services, and they are:

        Keylso – CNG Key Isolation – running

        SamSs – Security Account Manager – running

        VaultSvc – Credential Manager – running

        Any ideas what this is, or how to fix?

         

        Reply | Quote
    • glnz
      AskWoody Plus
      May 3, 2019 at 10:35 pm #1267210

      Update – in the detailed copies of the Audit Failure messages at the links at my post at the start here, the [Hex number] is associated with my One Drive, as I discovered in the registry.

      Is that a clue to the reason for the Audit Failures?

      Reply | Quote
    • glnz
      AskWoody Plus
      May 4, 2019 at 1:39 pm #1290347

      IMPORTANT NEW INFO:

      By checking my logs carefully, I can see that the Audit Failures start on the same day that I upgraded from Win 10 Version 1709 to Version 1803 – this past March 17.

      So is this problem baked into 1803?

      But why haven’t more people been complaining about it?

      Still need to know how to fix. Thanks.

      Reply | Quote
    • glnz
      AskWoody Plus
      June 17, 2019 at 12:43 pm #1846711

      Updating to 1903 has solved this problem.  Too bad MS won’t fix it for 1803 or 1809.

      Reply | Quote
    • EP
      AskWoody_MVP
      July 1, 2019 at 11:49 am #1864346

      I get different “audit failure” event 5061 message for “Microsoft Software Key Storage Provider” on v1803 and v1809 but only occasionally

      Reply | Quote
    • glnz
      AskWoody Plus
      July 1, 2019 at 12:17 pm #1864410

      Agree with EP – even on my 1903.  Has happened only once since my upgrade to 1903 two weeks ago.

      Reply | Quote
    Viewing 8 reply threads
    Reply To: Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information:




DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    June 2025
    S M T W T F S
    1234567
    891011121314
    15161718192021
    22232425262728
    2930  

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.