Excessive Security Log Events - Event ID 5379 - Windows 10

So this is a ridiculous issue.  If I was a hacker trying to cover my tracks, I would flood event logs with garbage like this.  Why doesn't Microsoft provide more details so that we can know the process generating these logs.  Why is it so hard to figure out what's going on here.

In my case, I get 50+ per minute and I cannot find bad activity because the log is flushed.  This issue should be raised as a security concern especially since the it involves the Security event logs.  

A tool that allows us to pinpoint the cause would alleviate the need for us to guesstimate the cause.  Does anyone know if tools like procmon.exe would help in identifying the process causing this issue? 

Note, I've checked my GPO and no Audit Policy settings are set; leading me to believe that a rogue process is logging them.

@Rashad Rivera,

If you look at other reports of "Audit Success" logging in the event logs, you will see that firstly this cannot (currently) be turned off, and secondly, it is NORMAL to see multiple entries for this, as Windows 10 internal functions are always checking when they start any activity, that they have the "credentials" to do so, and this is just showing "this software DLL/API or program was OK and valid with its assigned (normal or system) account ". So, I very much doubt this is a "rogue process", it is normal. You could check if any APPS are running in background mode that you don't need to, and check "autoruns" to see if there are any items that you do not need to start up with Windows when it boots.

There will be another ID number for "Audit failure", and you could set up a custom view yourself to see these if you want to, to aid troubleshooting.

I DO agree it is often excessive (Audit Success), and for techies looking for an issue, we SHOULD be able to turn it off (at least once before say a reboot).

I'm having the same problem. The system was fine last November and sat for about four months. When I turned it on last night, after all updates were applied and Outlook was downloading emails, the "freezing" issue started. After rebooting it stopped and I was hoping it was a one-time deal. After using the system for about 5 hours today, it started up again. Last night I was able to still use the computer, albeit very difficult. Today I wasn't even able to close windows (I think I managed to get two before I gave up and hit CTRL+ALT+DEL). The system was back to being normal/responsive after the ctrl/alt/del screen appeared (no idea what it's called). I logged out, forced applications to shut down (the shutdown process took a bit longer than usual), logged back in and the problem persisted. I rebooted the computer and the issue stopped.

I decided to take a peak in the Event Viewer since the issue seems bizarre. I, too, found many 5379 events. I usually don't even bother with the Event Viewer because of the plethora of events that tend to be logged in there. However, in this case, I think the 5379 events ARE significant. Looking at the time stamps, they began occurring around the same time the freezing issue began. I tried to use the computer while the issue was happening for about ten minutes and there were eight pages (around 130 entries) of 5379 events occurring within seconds of each other.

The same seems to be true from last night. There was a handful of 5379 events when I first logged in but during the first five hours of use there weren't hundreds of them, so... I'm off to search for more answers on this. Will come back here if I find one.

@Daved11 - I doubt very much that just because you see these (very normal) events, that it has ANYTHING relevant to your issue. Here is a description of the event; "Event 5379:

Credential Manager credentials were read. This event occurs when a user performs a read operation on stored credentials in Credential Manager"

So, just to be clear, ANY interface, or function that needs to check your account credentials via the Credential Manager before the function is allowed to execute (program/ap/api/DLL etc) will create this "OK" event.

Please post what your make/model of machine is, and what the Windows 10 level is. The easy way to do this is to right-click on the start icon (bottom left), choose "run" from the list, then key in winver in the command box. Post the version and OS build from the little window that comes up.

Also, what Anti-Virus program do you have, and have you been "persuaded" by advert clicks to add any (probably useless) "virus scanners" and Driver scanner checkers, that will "fight" for CPU and disk resources on your PC, and conflict with your actual anti-virus program?

I did notice my laptop, once it had updated to Feature Update 2004 (that means April 2020 ), the Windows Search Indexer became much more aggressive than before, and was running very actively for long periods. After a few hours, it settled down to normal. You can check what is running and taking up a lot of the CPU or Disk I/O by making intelligent use of the Task Manager. You can start that by right-click on any black (blank) space on the activity menu bar at the bottom, and choose Task manager from the list. When it start, let it settle down for about a minute, make sure you click on the "more details" link near the bottom left side if you have never run it before, then click on the "Processes" tab at the top. Check for any process or app/program using a high CPU% (more than 25% means a probable CPU core hog/loop). Post back anything running that you are not expecting to be running.

Go to C\users\your user account\apdata\local\Packages\Microsoft.zuneVideo bla bla bla\local state\database\

and delete the database.