8

Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.

There's no time to read it as the login succeeds.

In the event log I see:

Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:\ProgramData\Microsoft\Crypto\SystemKeys\

It says the key type is a user key.

Inside the 5061 Audit failure is the following information:

Cryptographic operation.

Subject:
Security ID:        SYSTEM
Account Name:       WIN-SOA3U4S9MJA$
Account Domain:     WORKGROUP
Logon ID:       0x3E7

Cryptographic Parameters:
Provider Name:  Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name:   454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type:   User key.

Cryptographic Operation:
Operation:  Open Key.
Return Code:    0x80090016

The details tab contains

System 

  - Provider 

   [ Name]  Microsoft-Windows-Security-Auditing 
   [ Guid]  {54849625-5478-4994-A5BA-3E3B0328C30D} 

   EventID 5061 

   Version 0 

   Level 0 

   Task 12290 

   Opcode 0 

   Keywords 0x8010000000000000 

  - TimeCreated 

   [ SystemTime]  2015-09-27T21:28:17.888978900Z 

   EventRecordID 6545 

  - Correlation 

   [ ActivityID]  {2E32FFFF-F96B-0003-D003-332E6BF9D001} 

  - Execution 

   [ ProcessID]  936 
   [ ThreadID]  408 

   Channel Security 

   Computer WIN-SOA3U4S9MJA 

   Security 


- EventData 

  SubjectUserSid S-1-5-18 
  SubjectUserName WIN-SOA3U4S9MJA$ 
  SubjectDomainName WORKGROUP 
  SubjectLogonId 0x3e7 
  ProviderName Microsoft Software Key Storage Provider 
  AlgorithmName RSA 
  KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8 
  KeyType %%2500 
  Operation %%2480 
  ReturnCode 0x80090016 

What is going on, and how do I fix it?

  • In the error report from event viewer, is there a field called Key Name:? – DrZoo Sep 25 '15 at 6:56
  • Yes, I wasn't sure if I should post it since it happens with every login – hellyale Sep 25 '15 at 13:04
  • @DrZoo is it safe to post? If so I'll edit it in when I get home – hellyale Sep 25 '15 at 15:25
  • yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge – DrZoo Sep 26 '15 at 15:05
  • @DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins. – hellyale Sep 26 '15 at 16:58
0

In windows 10, checking "delete browsing history on exit" in internet explorer 11 will generate this audit error.

Error is not generated in edge, firefox or chrome.

| improve this answer | |
  • 1
    How do you get it to stop? Happens every time I log in... also... I don't use IE 11, it isn't installed on the device, only edge, firefox, and chrome... – hellyale Nov 22 '15 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.