9
1
Logging in to Windows 10 Build 10547 I see for a split second a message box pop up.
There's no time to read it as the login succeeds.
In the event log I see:
Audit failure 5061 with a task category of System Integrity
The event directly previous is fetching a key from C:\ProgramData\Microsoft\Crypto\SystemKeys\
It says the key type is a user key.
Inside the 5061 Audit failure is the following information:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: WIN-SOA3U4S9MJA$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 454822bd-d329-d1b0-4211-07ccee6df7b8
Key Type: User key.
Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
The details tab contains
System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5061
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2015-09-27T21:28:17.888978900Z
EventRecordID 6545
- Correlation
[ ActivityID] {2E32FFFF-F96B-0003-D003-332E6BF9D001}
- Execution
[ ProcessID] 936
[ ThreadID] 408
Channel Security
Computer WIN-SOA3U4S9MJA
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName WIN-SOA3U4S9MJA$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
ProviderName Microsoft Software Key Storage Provider
AlgorithmName RSA
KeyName 454822bd-d329-d1b0-4211-07ccee6df7b8
KeyType %%2500
Operation %%2480
ReturnCode 0x80090016
What is going on, and how do I fix it?
In the error report from event viewer, is there a field called
Key Name:
? – DrZoo – 2015-09-25T06:56:22.097Yes, I wasn't sure if I should post it since it happens with every login – hellyale – 2015-09-25T13:04:38.960
@DrZoo is it safe to post? If so I'll edit it in when I get home – hellyale – 2015-09-25T15:25:47.370
yes it is safe to post. You can choose to omit some characters I'd you'd like. Based on other forums I've seen, the key is for IE or Edge – DrZoo – 2015-09-26T15:05:53.963
@DrZoo edited in key name, also, it is no longer happening with every log in, now only 50 - 60 % of logins. – hellyale – 2015-09-26T16:58:40.517
Are you a part of an active directory, or is this simply just a home PC? – DrZoo – 2015-09-27T02:10:43.407
It is just a home PC – hellyale – 2015-09-27T02:14:58.143
The only thing I've found where this occurs on a home PC, is when there is an issue with an Nvidia service. Do you have Nvidia drivers on your PC? – DrZoo – 2015-09-27T02:21:41.803
Only AMD graphics cards, maybe related though – hellyale – 2015-09-27T02:25:31.043
Well basically with the Nvidia problem, they used Nvidia DUU (Display Driver Uninstaller) to completely uninstall the drivers, rebooted the PC, and reinstall the drivers. – DrZoo – 2015-09-27T02:32:12.367
@DrZoo did the full uninstall with DDU, rebooted, and reinstalled, rebooted, and let windows do its update, rebooted, and it is still there =/ – hellyale – 2015-09-27T21:34:57.700
Let us continue this discussion in chat.
– hellyale – 2015-09-27T21:40:09.200Try the solution from this article : Local System Certificate store pooched after windows update.
– harrymc – 2015-09-28T05:33:05.497@harrymc negative sir, changed permissions, rebooted, problem persists. Thanks anyways. – hellyale – 2015-09-28T06:36:10.380
ReturnCode 0x80090016 = keyset does not exist. It could be related to the windows service that handles keys, in W2k it was "protected storage" not sure what is is in W10. Possibly the service is not loading in time. Just a guess. – Moab – 2015-10-01T21:22:53.037