Security Audit Failure Event 5061 In Windows 10

I am getting frequent Audit failures (System Integrity) even 5061 for my upgrade to Windows 10 from Windows 8.1.  These appear to be happening a few times a day.  The other posts made a couple suggestions about turning off crypto, windows update, etc... then restarting them. The problem recurs. 

As a lay person, I don't know what these mean or if they need to be fixed (I sure would feel better if there were not error messages showing up concerning system integrity!  If it should be fixed, how?  I find it strange that help doesn't help and no one on line seems to have good answers. Microsoft - any ideas?  Thanks,

 

Question Info


Last updated October 10, 2019 Views 18,221 Applies to:

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Do you happen to have a NVidia based graphics card in your computer?  I have been getting these errors on my PC as well and after doing quite a bit of digging, I have been able to track the failing key down to the one installed for the NVidia GameStream Server.  I am still not sure how to repair it, but I am guessing this is an issue with the latest NVidia graphics driver package.  You can check this for yourself, but running the command certutil –store my from a command window

24 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

 I did figure that out. My work around for this was to roll back the MS driver. Reinstall only the NVidia driver with out the extras. I then open the Computer Management window and go to Services. Once you get in to the services totally disable the NVidia Display Driver Service so it can't call home. I have found out that you will have to turn off the option to let Windows get the newest drivers. Because Windows will download and install the new driver with the extras. If that happens your back to square 1 all over again. That fixed it for me.

 But I ended up with a Event 5061, Microsoft Windows Security Auditing - Audit Failure. And; The Device Setup Manager (event 131,123, 200, 201 and 202 needs a real URL to call home to. I will figure this one out as well.

I also have another side note. Put the computer in safe mode. I have noticed that you will also need to disable the driver in safe mode to really kill it. If this is not done the service that you disabled will remain in a "Trigger Start" mode.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hello,

A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.

The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.

https://technet.microsoft.com/en-us/library/ff182311%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396#BKMK_1

Pat
As a responsible member of the community, please mark the reply that has resolved your issue. Thank you.

4 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I have not run the certutil yet, but NVidia may not be the issue. Our family has 4 machines and all four have the problems. 2 of the four have on board video and have the same issue.

2 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Don't think this is the issue.  There is no login problem with any of the machines.

1 person was helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I'm seeing these in my event log too. The failures happen four seconds before my video driver crashes (and restarts) while playing World of Warcraft. Could these two issues be related? I'm using onboard Intel HD 4600.

Audit Failure | Microsoft Windows security auditing. | 5061 | System Integrity

Cryptographic operation.

Subject:
Security ID: SYSTEM
Account Name: XXXXXX$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 51a92691-66f1-280f-d0db-59fad4f73491
Key Type: User key.

Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I have exactly the same problem - and the SAME KEY.

I have a Surface Pro (1), which has the Intel HD Graphics 4000 video card.

Regards,

Rod.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Thanks to Tim Stoppenbach for your insight, this has helped me solve this issue with my own NVIDIA GeForce GT610

Having run the CMD and entered certutil –store my it duly identified 'NVidia GameStream Server' as the culprit.

Following the above advice I tried a slightly different method, here's my own solution which worked for me and has solved the above issue, please note I do not play games on my PC or have any need for 3D features:

  • Solution:

    Open Programs & Features and Uninstall ALL NVidia Drivers except:-

    NVIDIA Graphics Driver
    NVIDIA HD Audio Driver  (you can uninstall this one as well if you don't use HD audio over HDMI)

Restart PC then re-run CMD Prompt and enter certutil -store my once more, you should then see the following information displayed 'Certutil: -store command completed successfully'

You can also check the event log to make sure that the Event ID: 5061 events are no longer generated

As per Tim's advice it is also recommended to disable the option to let Windows get the newest drivers. This should only be used as a temporary measure until the above issue is fixed.

Here's how:

Right click This PC and select Properties then Advanced System Settings in the right hand menu. This will launch a new System Properties window where you need to switch to the Hardware tab. Now select Device Installation Settings and select the following as shown in the image below.....

Dr.Slinky McVelvet - Inventor of the word 'Mellifluous'

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

This link my help

https://support.microsoft.com/en-us/kb/246183

I also saw in another post that enabling ie delete history can cause this error

let me know if it works

rob

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

@ Rob,

Many thanks for the link, unfortunately that advice does not apply to Windows 10.

Dr.Slinky McVelvet - Inventor of the word 'Mellifluous'

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.