This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography. So my Win 10 machine is insecure? I have run sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck. And I hardly even use my Win 10 machine - there are almost no apps on it yet. My actual Win 10 build is 17134.706
Here are the latest five Cryptography-related Audit Failures, from two reboots:
LATEST OF FIVE:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2019 12:27:52 PM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DESKTOP-3#####N
Description:
Cryptographic operation.
Subject:
Security ID: DESKTOP-3#####N[My user name]
Account Name: [My user name]
Account Domain: DESKTOP-3#####N
Logon ID: 0x3EC24
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: Microsoft Connected Devices Platform device certificate
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2019-04-28T16:27:52.339705400Z" />
<EventRecordID>19582</EventRecordID>
<Correlation />
<Execution ProcessID="880" ThreadID="948" />
<Channel>Security</Channel>
<Computer>DESKTOP-3#####N</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-[My Identifier 10-9-10 digits]-1001</Data>
<Data Name="SubjectUserName">[My user name]</Data>
<Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
<Data Name="SubjectLogonId">0x3ec24</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>
FOURTH OF FIVE:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2019 12:26:51 PM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DESKTOP-3#####N
Description:
Cryptographic operation.
Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3E5
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: [Hex number]
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2019-04-28T16:26:51.704606400Z" />
<EventRecordID>19552</EventRecordID>
<Correlation />
<Execution ProcessID="880" ThreadID="1004" />
<Channel>Security</Channel>
<Computer>DESKTOP-3#####N</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-19</Data>
<Data Name="SubjectUserName">LOCAL SERVICE</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e5</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">[Hex number]</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>
THIRD OF FIVE:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2019 11:29:28 AM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DESKTOP-3#####N
Description:
Cryptographic operation.
Subject:
Security ID: DESKTOP-3#####N[My user name]
Account Name: [My user name]
Account Domain: DESKTOP-3#####N
Logon ID: 0x3EF94
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: Microsoft Connected Devices Platform device certificate
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2019-04-28T15:29:28.196237300Z" />
<EventRecordID>19387</EventRecordID>
<Correlation />
<Execution ProcessID="884" ThreadID="928" />
<Channel>Security</Channel>
<Computer>DESKTOP-3#####N</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-[My Identifier 10-9-10 digits]-1001</Data>
<Data Name="SubjectUserName">[My user name]</Data>
<Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
<Data Name="SubjectLogonId">0x3ef94</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>
SECOND OF FIVE:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2019 11:28:27 AM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DESKTOP-3#####N
Description:
Cryptographic operation.
Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3E5
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: [Hex number]
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
<EventRecordID>19363</EventRecordID>
<Correlation />
<Execution ProcessID="884" ThreadID="992" />
<Channel>Security</Channel>
<Computer>DESKTOP-3#####N</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-19</Data>
<Data Name="SubjectUserName">LOCAL SERVICE</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e5</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">[Hex number]</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>
FIRST OF FIVE:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2019 11:28:27 AM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DESKTOP-3#####N
Description:
Cryptographic operation.
Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3E5
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: [Hex number]
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5061</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
<EventRecordID>19363</EventRecordID>
<Correlation />
<Execution ProcessID="884" ThreadID="992" />
<Channel>Security</Channel>
<Computer>DESKTOP-3#####N</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-19</Data>
<Data Name="SubjectUserName">LOCAL SERVICE</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e5</Data>
<Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
<Data Name="AlgorithmName">UNKNOWN</Data>
<Data Name="KeyName">[Hex number]</Data>
<Data Name="KeyType">%%2500</Data>
<Data Name="Operation">%%2480</Data>
<Data Name="ReturnCode">0x80090016</Data>
</EventData>
</Event>
So, what the *** are these, and how do we fix? No guesses - just the real fix.
glnzglnz
☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Just the usual DCOM ones that have been around since the ice ages of Windows. . So far so good for me. Some errors and warnings really can be safely ignored though. Ask Woody is great. The cautious side is always good.It is good to wait till 1903 rolls out to you. By then maybe some bugs will be fixed. Let me know when you do and your results. I will let you know if anything pops up that is important.
Coni - thanks - good to know your 1903 is still good. No other EventViewer Errors or Warnings?
I might give it a week or so to see how others are doing with 1903 before I upgrade. I'm also a fan of AskWoody, and he always keeps an eye out for problems with upgrades.
Please keep me posted.
Hi gnlz,
Whatever the reason for the audit failures you should not see them in 1903. I did not do a clean install,(I did the upgrade) and I do not have any audit failures after the upgrade.
I have always thought OneDrive was involved. I do not really trust "the cloud" very much.
I think on the connected devices platform I once read, I seem to recall, that it has to do with XBox. certificate. I never did have any problem with any of the games I play.
Anyway if your computers are ready for the upgrade, I would go ahead and do it to get some peace of mind from the audit failures.
Coni -
Maybe here's a clue - anyway, some additional info.
I looked at my Credential Manager for the first time ever. Under "Windows Credentials", under "Generic Credentials", there are a number of entries. One of them is for "OneDrive Cached Credential", and its User Name is the same [hex number] as I printed for Key Names at the very top of this thread in Fourth, Second and First of Five. Is this helpful in any way?
Unfortunately, none of the Credentials has a User Name that is "Microsoft Connected Devices Platform device certificate", which is the Key Name in the other two of Five that I posted at the top here.
Thoughts? Thanks.
glnzglnz
☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003
My laptop upgraded to 1903 this morning and I am not getting any audit failures. Yay!!! Hope it goes the same for you.
