I'm getting a ton of 5061 and 5058 entries on my 2008 R2 servers although the audit policy should be suppressing them. Why?
auditpol /get /category:*
returns the following.
System
....
Other System Events No Auditing
....
Based on my reading at What's New in Windows Security Auditing this should be the policy responsible for logging regarding 'Cryptography key file and migration operations'.
These events are from the Microsoft Software Key Storage Provider
and all focus on opening and managing the keys so it really sounds like that should be covered by the audit policy defined here.
What am I missing? I'm positive that the tertiary "Force audit policy subcategory settings" is enabled - the registry key is correct.