News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    Home Forums AskWoody support Windows Windows 10 Windows 10 version 1803 – April 2018 Update Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    This topic contains 11 replies, has 3 voices, and was last updated by

     glnz 3 weeks ago.

    • Author
      Posts
    • #1089597 Reply

      glnz
      AskWoody Lounger

       

      Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography.  So my Win 10 machine is insecure?  I have run sfc /scannow  and  Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck.  And I hardly even use my Win 10 machine – there are almost no apps on it yet.  My actual Win 10 build is 17134.706.

      I have posted about this in MS Technet at

      https://social.technet.microsoft.com/Forums/en-US/48425e2a-54c2-480d-8957-383415be2381/audit-failures-every-reboot-event-5061-cryptographic-operation-win-10-pro-64bit?forum=win10itprosetup

      Please go there for lots of detail and to let me know your thoughts (or come back here).

      Thanks.

       

    • #1094231 Reply

      Alex5723
      AskWoody Plus

      Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography. So my Win 10 machine is insecure? I have run sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck. And I hardly even use my Win 10 machine – there are almost no apps on it yet. My actual Win 10 build is 17134.706.

      I have posted about this in MS Technet at

      https://social.technet.microsoft.com/Forums/en-US/48425e2a-54c2-480d-8957-383415be2381/audit-failures-every-reboot-event-5061-cryptographic-operation-win-10-pro-64bit?forum=win10itprosetup

      Please go there for lots of detail and to let me know your thoughts (or come back here).

      Thanks.

      It seems like GPU/NVidia driver problem

      https://answers.microsoft.com/en-us/windows/forum/all/security-audit-failure-event-5061-in-windows-10/6de3cdd6-cb0a-478b-aca6-2f36e2eb85f6

      • #1097495 Reply

        glnz
        AskWoody Lounger

         

        Alex5723 – thanks.  But I don’t have a video card – not Nvidia and not anything else.  My graphics are built-in:  “Intel(R) HD Graphics”.  And I just tried to update its driver from Device Manager but I already have the latest.

        Also, I don’t have Xbox, I did not see XBL Client IPsec in the mmc certificate lists, and certutil -store my didn’t fix the problem.

        What do you think?

         

    • #1105213 Reply

      Alex5723
      AskWoody Plus

      Alex5723 – thanks. But I don’t have a video card – not Nvidia and not anything else. My graphics are built-in: “Intel(R) HD Graphics”. And I just tried to update its driver from Device Manager but I already have the latest.

      Also, I don’t have Xbox, I did not see XBL Client IPsec in the mmc certificate lists, and certutil -store my didn’t fix the problem.

      What do you think?

      Did you check “delete browsing history on exit” in internet explorer 11?
      If so, uncheck and test the system.

    • #1105953 Reply

      glnz
      AskWoody Lounger

      Alex –

      Where exactly in Win 10 Pro version 1803 will I find “delete browsing history on exit” in internet explorer 11?

      Just looked and did NOT find exactly that.

      Thanks.

    • #1107011 Reply

      Alex5723
      AskWoody Plus

      “delete browsing history on exit” in internet explorer 11

      https://www.computerhope.com/issues/ch001120.htm

      • #1215221 Reply

        glnz
        AskWoody Lounger

        Alex – thanks for suggestion, but setting IE to delete browsing history on exit does not help.  I’m still getting the Audit Failures on reboots.

        I did some more digging.

        On one of today’s reboots, there were three Audit Failures, Event 5061, for Cryptographic operation, all noting Process ID 888, which was lsass.exe, Local Security Authority Process

        So I right-clicked on lsass.exe and looked at its related services, and they are:

        Keylso – CNG Key Isolation – running

        SamSs – Security Account Manager – running

        VaultSvc – Credential Manager – running

        Any ideas what this is, or how to fix?

         

    • #1267210 Reply

      glnz
      AskWoody Lounger

      Update – in the detailed copies of the Audit Failure messages at the links at my post at the start here, the [Hex number] is associated with my One Drive, as I discovered in the registry.

      Is that a clue to the reason for the Audit Failures?

    • #1290347 Reply

      glnz
      AskWoody Lounger

      IMPORTANT NEW INFO:

      By checking my logs carefully, I can see that the Audit Failures start on the same day that I upgraded from Win 10 Version 1709 to Version 1803 – this past March 17.

      So is this problem baked into 1803?

      But why haven’t more people been complaining about it?

      Still need to know how to fix. Thanks.

    • #1846711 Reply

      glnz
      AskWoody Lounger

      Updating to 1903 has solved this problem.  Too bad MS won’t fix it for 1803 or 1809.

    • #1864346 Reply

      EP
      AskWoody_MVP

      I get different “audit failure” event 5061 message for “Microsoft Software Key Storage Provider” on v1803 and v1809 but only occasionally

    • #1864410 Reply

      glnz
      AskWoody Lounger

      Agree with EP – even on my 1903.  Has happened only once since my upgrade to 1903 two weeks ago.

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Audit Failures in every reboot of 1803 – Event 5061 Cryptography

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.