Excessive Security Log Events - Event ID 5379 - Windows 10

@RemoteComputerTechnician:

Do you regularly check your Event Logs for the 5379 "Audit Success" events?

If so, are you stating that after your profile change, these have stopped completely, or have they just reduced to an acceptable level?

I am also curious how you "moved" all of your required profile items, as quite often, profile manipulation of files INTO an active loaded (logged in) profile can be blocked. Was it done via a manual "drag and drop", or a PowerShell script, CMD/DOS script, or a third party product?

Did ALL of your normal/expected win32 programs and APPS work as normal with your new profile. Was this a LOCAL account or Microsoft Account profile by the way?

Non of it matters because the 5379 Audit Success postings are back. I thought they were gone, but no, they are back.

@RemoteComputerTechnician as you have posted several "solutions" on here, that have only turned out to NOT change the issue, I would respectfully suggest that you THOROUGHLY test any and ALL changes that you try, for at least 1 to 2 weeks, before posting them on here, as it may cause confusion, and if users try these, it might cause them issues if they no not have the proper skills to do it properly, and be unable to revert a bad change.

As I have posted on here a few times, these 5379 Audit Success event logs are a NORMAL part of the Microsoft Security reporting "system", and do NOT signify a problem that any users need to fix, and there is NO PROBLEM with their hardware or software, and NO rogue processes running doing bad stuff.

Many enterprise users actually WANT auditing events, that is why they are there, HOWEVER, most regular users do NOT want this (as it can be excessive), and ideally, Microsoft should be providing a setting for Windows 10 Home and Pro users to be able to turn this OFF.

Maybe those who aggree with that, should be posting that suggestion in the Feedback Hub, and vote up any others who have done this.

For users getting freezes, and game-play lags, performance issues, should NOT look here for a solution, as these 5379 events have NOTHING to do with that.

It may well be the other well posted problem of long run times for the scheduled runs of WaasMedic and CompatTelrunner services.

Whether they are normal or not, these events can be linked to problems. I have been trying to track down an intermittent black pop-up window that appears for a couple tenths of a second then disappears (it is rectangular, portrait orientation, center of screen). It is super annoying and driving me crazy. It turns out is happening EXACTLY when a cluster of 5379 events occurs.

I know it's not necessarily the audit per se causing it, but how can I find out what underlying event or process is triggering this intermittent flashing window and the simultaneous audit?

Yes, it is a problem. My computer ran all night doing successful audits (5379). It's doing it now. It does it ceaselessly.