Excessive Security Log Events - Event ID 5379 - Windows 10

@SMichaelH3 - The "black popup window" is actually the CMD (command shell window) - used to be called the "DOS prompt". However, many older (and some newer) WIN32 programs (.EXE executable programs), such as photo or video editors, music file editors and old utilities, will often use a batch file (.BAT file type) that runs, often just after booting up, that will check that you have a valid current licence key, and if there are any updates needed. Batch files can run very quickly, and they do NOT leave the CMD prompt open, hence you see it appear and go very quickly. I saw a post that certain AMD based PC/Laptops have the AMD Catalyst Control centre that can do that CMD thing as well.
Given the speed of modern CPU and harware, and the likelyhood that several BILLION instructions and I/O calls are made during a typical boot and PC initialise, AND probably Billions more during the "post-boot phases" (checking PC health, programs checking for valid licences, onedrive and Dropbox sync checks, Ant-Virus definition update checks etc), then unless you are running a special "debug windows build", and have trace and log analysis tools, then is NO possible way that you will be able to KNOW and PROVE, that a bunch of 5379 events were EXACTLY coincidental, and the root cause (or effect of) of the CMD windows appearing. Actually ANY activity that uses your user profile (your login account environment files basically, plus related "system" account activity) will trigger the "audit success" event 5379, plus some other similar types for running services. Because of the "parallel" overlapping core/thread activities, many things can appear to be happening very close together, and in a microsecond, MANY CPU operations and instructions happen, running on behalf of many active processes. In additon, those processes that execute an I/O (input/output operation) can be "context switched" out and in a wait state, allowing other processes to get some "CPU time" for their instruction sequences.

This explanation explains but does not help. I finally had to nuke my computer and reinstall, which cured the problem but obviously created others.

@David Salmon - even fresh installs will have 5379 events. It is a NORMAL "info" event, just a standard audit event, for user activity that uses credentials. It is NOT signifying any problem - it is just annoying and a bit excessive for normal home systems.

Hey guys, sorry I'm a bit late to this thread, I've been having this issue for about 3 months now and its been driving me insane, however I think I've found a workaround solution that doesn't require installing new hardware.

First of all, I removed my Microsoft account from my PC and left only a local account, from there go to control panel and go to credentials manager, then remove all of the access' listed. Then in services, disable credential manager and credentialenrollmentmanager. After that navigate to system32 and disable auditing of the applications rooted to the services - lsass.exe and credentialenrollmentmanager.exe, I also disabled inheriting and revoked access to read and write by taking ownership of the applications.

I do not know for sure whether each step is necessary, however this has stopped the excessive amounts of 5379 audits completely, and my pc is running much more smoothly because of it ( I was getting about 10 new audits whenever a window or overlay opened or was switched to/brought to front). Also disabling the server service might be important as well, I'm unsure of whether it impacted the results.

@nathanhowell3 - have you checked that things like Windows updates, Windows store, and ONeDrive still work? How about Windows Security (Defender) does it still open?