Fing causing Event ID: 5379 messages

TechnicialKatTechnicialKat Member Posts: 1
Photogenic
Under Windows (v 10) logs I am receiving Event ID: 5379 messages multiple times a minute, see below for message frequency and the detail of messages (the 5379 detail is all the same.)  While this message is informational "This event occurs when a user performs a read operation on stored credentials in Credential Manager." it happens so frequently that it fills the log and makes it time consuming to review messages that could relate to a real issue.

Information 6/7/2020 7:06:55 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:55 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:54 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:53 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:53 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:52 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:51 PM Microsoft Windows security auditing. 4672 Special Logon
Information 6/7/2020 7:06:51 PM Microsoft Windows security auditing. 4624 Logon
Information 6/7/2020 7:06:51 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:50 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:50 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:49 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:48 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:48 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:47 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:46 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:45 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:45 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:44 PM Microsoft Windows security auditing. 5379 User Account Management
Information 6/7/2020 7:06:43 PM Microsoft Windows security auditing. 5379 User Account Management

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          6/7/2020 7:06:55 PM
Event ID:      5379
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      XXXXXXX
Description:
Credential Manager credentials were read.

Subject:
Security ID: XXXXXXX\XXXXXX
Account Name: XXXXXX
Account Domain: XXXXXXX
Logon ID: 0x62D59
Read Operation: Read Credential

This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Event Xml:
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>5379</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2020-06-08T02:06:55.386101500Z" />
    <EventRecordID>4772625</EventRecordID>
    <Correlation ActivityID="{d40cbd6e-3c77-0002-f5bd-0cd4773cd601}" />
    <Execution ProcessID="576" ThreadID="688" />
    <Channel>Security</Channel>
    <Computer>XXXXXXX</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-3244779120-584261681-85297669-1000</Data>
    <Data Name="SubjectUserName">XXXXXX</Data>
    <Data Name="SubjectDomainName">XXXXXXX</Data>
    <Data Name="SubjectLogonId">0x62d59</Data>
    <Data Name="TargetName">Fing for Desktop/access_token</Data>
    <Data Name="Type">1</Data>
    <Data Name="CountOfCredentialsReturned">1</Data>
    <Data Name="ReadOperation">%%8099</Data>
    <Data Name="ReturnCode">0</Data>
    <Data Name="ProcessCreationTime">2020-06-07T03:03:20.953458100Z</Data>
    <Data Name="ClientProcessId">4576</Data>
  </EventData>
</Event>

Comments

  • RobinRobin Administrator Posts: 2,386
    100 Answers 1000 Comments 250 Likes 25 Agrees
    admin
    Hi @TechnicialKat
    I have seen multiple users are facing issues with Fing desktop notifications and connection error.
    An update for the reported issue:
    Our developers are investigating some issue happened after the last release of mobile apps. There is an unusual load on our servers that is saturating the resources. And because of this Fing desktop has started to send false alarms.

    Today as a workaround we will tune the config to try to make the server keep up but the issue on the mobile apps is under investigation.
    I hope it helps. And soon as there is some more update I will let you know.
    Robin (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
Sign In or Register to comment.