What is the Security Event id :- 5058? How to resolve it?

Hi Team,
We have a cloud service hosted in Azure through VSO & we are getting following Security Log very aggressively.
Please let us know what this Event Id describes & how can we resolve this such that we won't get these events logged aggressively again.
Here is Event Id Details for your information:-
{54849625-5478-4994-A5BA-3E3B0328C30D}
Microsoft-Windows-Security-Auditing
5058
Security
0
12292
Key file operation. Subject: Security ID: S-1-5-18 Account Name: RD0003FF61F511$ Account Domain: WORKGROUP Logon ID: 0x3E7 Cryptographic Parameters: Provider Name: Microsoft Software Key
Storage Provider Algorithm Name: UNKNOWN Key Name: {1C3A7A2B-6D7A-4BAB-BADA-A444D085431F} Key Type: Machine key. Key File Operation Information: File Path: D:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\06aa7d6bbf51b94901c19f7afe3d9ea0_f04684e6-d147-49ca-b159-984fa865488b
Operation: Read persisted key from file. Return Code: 0x0
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>5058</EventID><Version>0</Version><Level>0</Level><Task>12292</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated
SystemTime='2015-03-27T02:21:29.055257000Z'/><EventRecordID>3737</EventRecordID><Correlation/><Execution ProcessID='604' ThreadID='1732'/><Channel>Security</Channel><Computer>RD0003FF61F511</Computer><Security/></System><EventData><Data
Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>RD0003FF61F511$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ProviderName'>Microsoft
Software Key Storage Provider</Data><Data Name='AlgorithmName'>UNKNOWN</Data><Data Name='KeyName'>{1C3A7A2B-6D7A-4BAB-BADA-A444D085431F}</Data><Data Name='KeyType'>%%2499</Data><Data Name='KeyFilePath'>D:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\06aa7d6bbf51b94901c19f7afe3d9ea0_f04684e6-d147-49ca-b159-984fa865488b</Data><Data
Name='Operation'>%%2458</Data><Data Name='ReturnCode'>0x0</Data></EventData></Event>
I have followed this article @ http://eventopedia.cloudapp.net/EventDetails.aspx?id=300ea4a0-321b-4e93-80a2-9f6277fe1498 ; but didn't get any useful information.
Thanks.
Regards,
Subhash Konduru
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Hello Subhash,
Thanks for posting here!
You might want to see this link:
http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/loose-internet-connection-every-hour-matches-when/9e4c4984-263a-4d33-bd6c-b6335e5a0197
Hope this helps you identifying and resolving the issue.
Let me know if you have any further queries.
Regards,
Sadiqh

Similar Messages

What are the security post refresh procedures in general?

Hi,
Can anyone list me out What are the security post refresh procedures in general?
Thanks and Regards,
Damanaidu J

>
Damanaidu jawaharlal wrote:
> Hi,
>
> Can you cite with respect to CUA.
>
> Thanks and Regards,
> Damanaidu J
CUA
====
CUA behaves differently during a system/client copy and this is the approach we took and it was successful. The goal is to take a backup of the source before CUA deletion then restore. Do not delete CUA and just attempt to rebuild it, all the roles will be gone. Backup and restore will be the approach I recommend.
a1. Take a snap shot of your QA user and role assignments before copy.
1. (Basis) First make a backup of the source system. This is important before step 2.
2. After successful backup delete the CUA from the source system.
3. After successful copy to target system, restore backup to source system.
4. Depending how the copy was done, users and passwords should be in the target system but all the role assignments will be gone.
5. Start assigning roles base on your requirements. If you need to restore the old QA settings that is captured in a1.
Perhaps others can add in other steps I might have missed.
Good Luck!

Data Access Service is unable to log audit events to the security event log

Hi,
Scenario: SCOM 2012 R2 UR4. (Windows 2012 R2)
Today SCOM have generated 4 alerts Data Access Service is unable to log audit events to the security event log.
The service account for "System Center Data Access Service" service is "Local System".
The users at "Generate security audits" are: LOCAL SERVICE and NETWORK SERVICE.
The question is:
how to resolve this alert? (Where look for to obtain more information to resolve this problem)
Thanks in advance!

Local system account is differet to local service account. Fo detail description of these accounts, pls. refer
LocalService Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx
LocalSystem Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
Generate security audits which is under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment of Group policy, determines which accounts can be used by a process to add entries to the security log. This user right
is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.
For identified the SDK account
1) open services.msc
2) From the system Center Data Access Service, you can see the SDK logon on as account
Roger

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

You want to allow someone to open your document and fill out the form (in the fields you have created), but not change or edit the form, right? Here's the answer - assuming you are using Acrobat Pro and someone will be opening the PDF using at least Acrobat Reader 9 and up:
Tools > Protection > Encrypt < Encrypt with Password
Answer YES to change the security.
A new window opens:
     Do NOT select Document Open (or that will require a password to open the document.)
     Select: Permissions (Check the box next to "Restrict editing and printing of the document.")
     Change the following 2 settings from the drop-down box:
          Printing Allowed: Select High Resolution
          Changes Allowed: Select Commenting, filling in form fields, and signing signature fields
          Leave selected: "Enable text access for screen reader devices for the visually impaired"
          Change Permissions Password (insert a strong password)
          Leave all other settings alone in "Options"
          OK - OK
          Re-enter the Permissions Password (the one you entered above)
          OK - OK
          Save the PDF to apply the security [notice that (SECURED0 will appear after the document title]

What's the Commitment item? And how to use it?

When I create a G/L account by FS00 I need to input a Commitment item.
But I don't know how to use it.
Can you tell me what's the Commitment item? And how to use it?
Thank you very much.
Moderator: Try pressing F1 or going to help.sap.com

>>In SAP XI / PI, WS adapter is not thier frm standard SAP.
Are you sure about this?
WS is a standard adapter shipped along with PI 7.1 installation.
Quote from help.sap.com
Using the WS adapter you can configure the communication of systems, which communicate with each other using the Web service runtime either directly (point-to-point) or using the Integration Server
Refer:
http://help.sap.com/saphelp_nwpi71/helpdata/en/0d/5ab43b274a960de10000000a114084/content.htm
http://help.sap.com/saphelp_nwpi71/helpdata/en/45/37d73b80554c2ce10000000a1553f6/frameset.htm
If you are not sure about what you are saying, it is better not to say it.

Hi,I have problem with my mac's storage. I deleted some documents,but the storage involves 34Gb other,what does the other consist of? how can I do my mac's storage specially other free?

Hi,I have problem with my mac's storage. I deleted some documents,but the storage involves 34Gb other,what does the other consist of? how can I do my mac's storage specially other free?

1. Empty Trash.
    http://support.apple.com/kb/PH10677
2. Delete "Recovered Messages", if any.
    Hold the option key down and click "Go" menu in the Finder menu bar.
    Select "Library" from the dropdown.
    Library > Mail > V2 > Mailboxes
    Delete "Recovered Messages", if any.
    Empty Trash. Restart.
3. Repair Disk
    Steps 1 through 7
    http://support.apple.com/kb/PH5836
4. Disk space / Time Machine ?/ Local Snapshots
   http://support.apple.com/kb/ht4878
5. Re-index Macintosh HD
   System Preferences > Spotlight > Privacy
   http://support.apple.com/kb/ht2409

What are the security implications of having JAVA running on my Mac Book Pro?

What are the security implications of having JAVA running on my Mac Book Pro?

Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it — not JavaScript — in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.

What are the security risks for opening port 80 on workstations?

Hello all,
in our environment, there is an application which open port 80 on workstations when installed, but it is not allowed on preimeter FW
could you please advise what are the security risks for leaving port 80 opened on the workstations? or it is considered secure unless it is not allowed on the preimeter FW?
thanks alot & regards

Hi R.Naguib.
The 80 port is open by default through the firewall on Windows system, it is used by a http protocol by a browser.
As for the network or hardware Firewall settings, I suggest to turn to the network administrator for details.
Regards
Wade Liu
TechNet Community Support

What Are the Security Implications of not Completely Signing Database?

Hello everyone,
What are the security implications of not completely signing the database?
From http://www.archlinux.org/pacman/ ,
The following quote implies that the database exists merely just in case hand tweaking is necessary:
maintains a text-based package database (more of a hierarchy), just in case some hand tweaking is necessary.
However, considering that there are cases that pacman's local database needs to be restored, there are implications that the database is essential for pacman to function properly.
From https://wiki.archlinux.org/index.php/Ho … l_Database :
Restore pacman's local database
Signs that pacman needs a local database restoration:
- pacman -Q gives absolutely no output, and pacman -Syu erroneously reports that the system is up to date.
- When trying to install a package using pacman -S package, and it outputs a list of already satisfied dependencies.
- When testdb (part of pacman) reports database inconsistency.
Most likely, pacman's database of installed software, /var/lib/pacman/local, has been corrupted or deleted. While this is a serious problem, it can be restored by following the instructions below.
I know that all official packages (from core, extra, community, etc.) are signed so that all files should be safe, but I'm just paranoid.
What if the database was hacked? Will this lead to installation of harmful software?
Sincerely,
Cylinder57
Last edited by Cylinder57 (2012-10-15 03:42:31)

Cylinder57 wrote:
From this quote:
Allan wrote:But, the OP (also?) talks about the local package database on his computer. That is not signed at all as there is no point. If someone can modify that, then they can regenerate the signature, or just modify any other piece of software on your computer.
Is it going to be easy for anyone other than the authorized user to modify the local package database?
Allan basically answered that with the quote above already as I understand it. Someone who has access to the installation, e.g. is able chrooting your PC via USB, is not held back by any ACLs. However, modifying the local database only makes limited sense because the packages are already installed. Pacman would only recheck, if you re-install a package. The only really relevant attack vector for the package database is
(1) installing an older package with a vulnerability,
(2) re-placing the up-to-date package sig in the local database with the older one and
(3) modifying the system, e.g. via pacman.conf excludes, to not update that.
then also re-installing would not create a sig-error and you get stuck with the bogus old package.
With a signed database this would not be possible. However, as Allan wrote earlier also with a signed database that criminal can manually install (totally leaving pacman & package cache) whatever it needs in this scenario. So, if you are -really- paranoid about that, you probably want to spend (a lot of configuring) time with something like the "aide" package.
Cylinder57 wrote:
And, are the following statements correct:
If the repository databases are modified, the hacker might be able to modify the packages on the server (Considering that if someone can modify the local package database, that person can modify any other piece of software on that particular computer.)
However, pacman won't let users from installing the modified packages (due to package signing,) unless at one person with access is bribed (at least, for an individual package.)
I don't know the intricacies of the server infrastructure - only saw they have great names :-), but I am pretty certain your statements assume that correctly. It is pretty unlikely that someone able to modify the central repository database fails at placing a bogus package for shipping with those access rights at this time. Yet it does no harm not to post any details of such a scenario here imo. In any case: A compromised mirror would be enough for that - and easier to achieve (hacked anywhere or e.g. in a non-democratic state). Plus you also answered it yourself. The keys are key for our safety there. Which keeps me hoping that no criminal lawnmover salesmen frequent the Brisbane area.
As you put up a thread about this, one question you can ask yourself is:
Have you always checked on updates new signatures keys which pacman asks about? If you ever pressed "accept/enter" without checking them out-of-band (e.g. the webserver), that compromised mirror database might have just created a "legitimate" key .. user error, but another attack vector the database signing would catch.
edit: Re-thinking the last paragraph just after posting, I now believe it would not be that easy as implied - simply because the bogus key is not trusted by one of the master keys. The pacman pgp trust model should catch that without database signing. At least it would if only the official repositories are activated, but that's a pre-requisite to the whole thread.
Last edited by Strike0 (2012-10-20 23:01:26)

WHAT IS THE SECURITY CODE I'M LOST

what is the security code i'm really lost

Secret code for what? Do you mean forgotten passcode? If so you need to restore with the computer and iTunes you used to back it up, so the restore will remove the passcode.

What are the external events of a report?

Hi,
Please tell me if you have any idea about what are the external events of a Report?
Thanks in advance.
MD.

Hi,
When you run an executable program, the program flow is controlled by the external events in the ABAP runtime environment. The following diagram shows the sequence of the events:
check this link for more....
http://help.sap.com/saphelp_nw70/helpdata/en/9f/db99fa35c111d1829f0000e829fbfe/content.htm
Regards,
Shanthi.P
Reward points if useful ***

What's the FPGA step size and how to calculate it?

Hi there,
I inherited an vi with problem in it. It's basically reading the binary file then display it. So the vi reads the binary file by using Read From Binary File, the output data from this function then sends to FPGA after multiply a number (32767/10). But unfortunately I got a wrong output. The final output value for some reasons looks got attenuated. People told me maybe it's related to the FPGA step size, so I want to know what is the FPGA step size and how to calculate it. Can someone answer my questions here?
Thanks in advanced!!!

Hi Weny,
It sounds like you are trying to find out the output resolution of your FPGA module. It would be helpful if you provided what FPGA module you are using in your tests so we know what information to provide. For instance, the R Series Manual provides information on how to calculate the required DAC output code to generate the desired output voltage. You should also try to keep the accuracy of your device in mind. The analog output signal you are generating will be subject to gain, offset, and noise errors. You can use the specifications sheet (such as the R Series Specifications) of your device to determine what accuracy your board will have. The specs also provide information on the resolution of the board. You can search ni.com for the manual and specifications for your particular device if you are not using R Series.
Regards,
Browning G
FlexRIO R&D

What does the bookmark bar do? How does it work?

What does the bookmark bar do? How does it work?

You can use the bookmarks bar in Safari to have links to some sites permanently shown at the top of the screen below the address field and icons - so you just have to tap the link on the bar to go to that site as opposed to tapping the bookmarks icon and finding the link in there. So it's just a slightly quicker way to go some of your more regularly used sites

OpsMgr EventId 26007 on Domain Controllers "The EventLog service reported that the Security event log on computer ' ' is corrupt."

Hi,
We are receiving several eventids '26007' from the OpsMgr log on our Domain Controllers, also eventids '26008' with similar description are logged
The EventLog service reported that the Security event log on computer '<Domain Controller Computer>' is corrupt. The Windows Event Log Provider will attempt to recover by re-opening log.
I'll appreciate any suggestion in order to solve this issue.
Regards.

I guess this issue is caused by event ID 4661 is corrupted in security event log.
Please check if you have many 4661 events in security event log and XML view cannot be viewed.
Running the below command on DC will disable the auditing of the SAM Object access. This should stop the Event ID 4661 from being logged which should stop the Alert regarding corrupt Event log:
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
Regards,

What is the security slot? What is it for?

What is the security slot? What is it for?

Primarily for a retail store or business to anchor the device using a locking mechanism....so the AirPort won't fly away.

What is the Security Event id :- 5058? How to resolve it?

Similar Messages

Maybe you are looking for