Excessive Security Log Events - Event ID 5379 - Windows 10

Anonymous
2020-04-26T06:15:06+00:00

I have been experiencing Windows Application crashes on my 3 month old Windows 10 install. While troubleshooting, I noticed that there 50+ security events each minute in the Event Viewer under Windows Logs > Security.  

Is this normal?  

The majority are Audit Success Messages with the Event ID 5379.  There are approximately 50 of these identical messages every minute. Thanks for any insight on this.

See below for typical Message:

Credential Manager credentials were read.

Subject:

Security ID: DESKTOP\*****

Account Name: *****

Account Domain: DESKTOP

Logon ID: 0x354889

Read Operation: Enumerate Credentials

This event occurs when a user performs a read operation on stored credentials in Credential Manager.

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-08-11T08:21:21+00:00

    @David Salmon - even fresh installs will have 5379 events. It is a NORMAL "info" event, just a standard audit event, for user activity that uses credentials. It is NOT signifying any problem - it is just annoying and a bit excessive for normal home systems.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  2. Anonymous
    2021-08-01T16:15:16+00:00

    Whether they are normal or not, these events can be linked to problems. I have been trying to track down an intermittent black pop-up window that appears for a couple tenths of a second then disappears (it is rectangular, portrait orientation, center of screen). It is super annoying and driving me crazy. It turns out is happening EXACTLY when a cluster of 5379 events occurs.

    I know it's not necessarily the audit per se causing it, but how can I find out what underlying event or process is triggering this intermittent flashing window and the simultaneous audit?

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  3. Anonymous
    2021-03-01T14:52:45+00:00

    I had the same problem.

    First thing to do is run a cmd prompt as administrator

    at the prompt run the following

    sfc /scannow

    when that finishes, read the results.

    disconnect any usb connections and any flash drives.

    Restart computer

    Clear security and other logs.

    Restart again.

    Now look at the security log and see if the replication has stopped.

    If it has, then one by one add back the flash drives or usb connections to find the one that is causing the problem

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  4. Anonymous
    2020-06-20T05:22:20+00:00

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  5. Anonymous
    2020-05-12T08:59:10+00:00

    Well I don't know if this is a problem. Honestly, I came here expecting to solve this issue to fix some stuttering I had. What I ended up doing was going into Device Manager and changing all my IDE ATA/ATAPI Drivers from AMD ACHI, to the Standard SATA ACHI Controller. Not sure if it'll fix your issues, but it helped me.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments