0

I'm getting a ton of 5061 and 5058 entries on my 2008 R2 servers although the audit policy should be suppressing them. Why?

auditpol /get /category:* returns the following.

System
  ....
  Other System Events                     No Auditing
  ....

Based on my reading at What's New in Windows Security Auditing this should be the policy responsible for logging regarding 'Cryptography key file and migration operations'.

These events are from the Microsoft Software Key Storage Provider and all focus on opening and managing the keys so it really sounds like that should be covered by the audit policy defined here.

What am I missing? I'm positive that the tertiary "Force audit policy subcategory settings" is enabled - the registry key is correct.

1
  • I´ve seen a web debugging proxy (like Fiddler) generates a lot of 5061 and 5058 events when decrypt HTTPS traffic is enabled
    – Troglo
    Jul 1, 2015 at 11:03

1 Answer 1

1

I finally have an answer after a lot of searching.

Apparently this is under a different heading than it sounds like it should be one is Audit System Integrity the other Audit Other System Events.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .