Events 5058/5061 - W2008 server, very high... Expand / Collapse
Author
Message
Posted 6/18/2013 12:42:45 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/18/2013 12:34:12 PM
Posts: 2, Visits: 0
On a member server I look after I'm seeing vast quantities of events 5058 (key file operation, read persisted key from file, return code 0x0) and 5061 (crypto operation, open key, return code 0x0). Sometimes up to 8 events per second making the security log fairly useless to find anything else!

Obviously some kind of auditing is turned on - I ran auditpol but it's not obvious what is turned on to cause this and how necessary it is. This was set up by my predecessor.

Can anyone give me any background into what could cause these two events to repeat at such a high frequency?

Thanks

Andy

Post #1239
Posted 6/19/2013 3:51:30 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/18/2013 12:34:12 PM
Posts: 2, Visits: 0
Many thanks for the reply. Do you know what these two events are likely to be recording, is it going to be logging an internal windows process which is reading a key or possibly something outside of the system? I know it's a bit of a vague question but I'll need to justify turning this auditing off.

Thanks

Andy

Post #1241
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:34pm