Excessive Security Log Events - Event ID 5379 - Windows 10

Anonymous
2020-04-26T06:15:06+00:00

I have been experiencing Windows Application crashes on my 3 month old Windows 10 install. While troubleshooting, I noticed that there 50+ security events each minute in the Event Viewer under Windows Logs > Security.  

Is this normal?  

The majority are Audit Success Messages with the Event ID 5379.  There are approximately 50 of these identical messages every minute. Thanks for any insight on this.

See below for typical Message:

Credential Manager credentials were read.

Subject:

Security ID: DESKTOP\*****

Account Name: *****

Account Domain: DESKTOP

Logon ID: 0x354889

Read Operation: Enumerate Credentials

This event occurs when a user performs a read operation on stored credentials in Credential Manager.

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-08-13T05:04:57+00:00

    Hey guys, sorry I'm a bit late to this thread, I've been having this issue for about 3 months now and its been driving me insane, however I think I've found a workaround solution that doesn't require installing new hardware.

    First of all, I removed my Microsoft account from my PC and left only a local account, from there go to control panel and go to credentials manager, then remove all of the access' listed. Then in services, disable credential manager and credentialenrollmentmanager. After that navigate to system32 and disable auditing of the applications rooted to the services - lsass.exe and credentialenrollmentmanager.exe, I also disabled inheriting and revoked access to read and write by taking ownership of the applications.

    I do not know for sure whether each step is necessary, however this has stopped the excessive amounts of 5379 audits completely, and my pc is running much more smoothly because of it ( I was getting about 10 new audits whenever a window or overlay opened or was switched to/brought to front). Also disabling the server service might be important as well, I'm unsure of whether it impacted the results.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2021-08-10T14:02:27+00:00

    This explanation explains but does not help. I finally had to nuke my computer and reinstall, which cured the problem but obviously created others.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2020-06-16T19:26:30+00:00

    My IDE ATA/ATAPI Drivers are set to Standard SATA ACHII.

    I am having the same problem on version 18363.900

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-05-11T05:50:55+00:00

    Having same issue. If I find a fix I'll post it. I hope ya'll do the same.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-04-26T07:00:41+00:00

    Windows 10 Pro

    Ver 1909 (OS Build 18363.778)

    Was this answer helpful?

    0 comments