Excessive Security Log Events - Event ID 5379 - Windows 10

This explanation explains but does not help. I finally had to nuke my computer and reinstall, which cured the problem but obviously created others.

@SMichaelH3 - The "black popup window" is actually the CMD (command shell window) - used to be called the "DOS prompt". However, many older (and some newer) WIN32 programs (.EXE executable programs), such as photo or video editors, music file editors and old utilities, will often use a batch file (.BAT file type) that runs, often just after booting up, that will check that you have a valid current licence key, and if there are any updates needed. Batch files can run very quickly, and they do NOT leave the CMD prompt open, hence you see it appear and go very quickly. I saw a post that certain AMD based PC/Laptops have the AMD Catalyst Control centre that can do that CMD thing as well.
Given the speed of modern CPU and harware, and the likelyhood that several BILLION instructions and I/O calls are made during a typical boot and PC initialise, AND probably Billions more during the "post-boot phases" (checking PC health, programs checking for valid licences, onedrive and Dropbox sync checks, Ant-Virus definition update checks etc), then unless you are running a special "debug windows build", and have trace and log analysis tools, then is NO possible way that you will be able to KNOW and PROVE, that a bunch of 5379 events were EXACTLY coincidental, and the root cause (or effect of) of the CMD windows appearing. Actually ANY activity that uses your user profile (your login account environment files basically, plus related "system" account activity) will trigger the "audit success" event 5379, plus some other similar types for running services. Because of the "parallel" overlapping core/thread activities, many things can appear to be happening very close together, and in a microsecond, MANY CPU operations and instructions happen, running on behalf of many active processes. In additon, those processes that execute an I/O (input/output operation) can be "context switched" out and in a wait state, allowing other processes to get some "CPU time" for their instruction sequences.

Yes, it is a problem. My computer ran all night doing successful audits (5379). It's doing it now. It does it ceaselessly.

Whether they are normal or not, these events can be linked to problems. I have been trying to track down an intermittent black pop-up window that appears for a couple tenths of a second then disappears (it is rectangular, portrait orientation, center of screen). It is super annoying and driving me crazy. It turns out is happening EXACTLY when a cluster of 5379 events occurs.

I know it's not necessarily the audit per se causing it, but how can I find out what underlying event or process is triggering this intermittent flashing window and the simultaneous audit?

@RemoteComputerTechnician as you have posted several "solutions" on here, that have only turned out to NOT change the issue, I would respectfully suggest that you THOROUGHLY test any and ALL changes that you try, for at least 1 to 2 weeks, before posting them on here, as it may cause confusion, and if users try these, it might cause them issues if they no not have the proper skills to do it properly, and be unable to revert a bad change.

As I have posted on here a few times, these 5379 Audit Success event logs are a NORMAL part of the Microsoft Security reporting "system", and do NOT signify a problem that any users need to fix, and there is NO PROBLEM with their hardware or software, and NO rogue processes running doing bad stuff.

Many enterprise users actually WANT auditing events, that is why they are there, HOWEVER, most regular users do NOT want this (as it can be excessive), and ideally, Microsoft should be providing a setting for Windows 10 Home and Pro users to be able to turn this OFF.

Maybe those who aggree with that, should be posting that suggestion in the Feedback Hub, and vote up any others who have done this.

For users getting freezes, and game-play lags, performance issues, should NOT look here for a solution, as these 5379 events have NOTHING to do with that.

It may well be the other well posted problem of long run times for the scheduled runs of WaasMedic and CompatTelrunner services.