Event ID 5061
Cryptographic operation.Cryptographic operation.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Cryptographic Parameters:
Provider Name: %5
Algorithm Name: %6
Key Name: %7
Key Type: %8
Cryptographic Operation:
Operation: %9
Return Code: %10Event ID 5061 is a Windows Security log entry that records a handle request when an application opens a securable object (file, registry key, etc.) while "Object Access" auditing is enabled. The record includes the handle ID, object type and name, requested access mask, the user and process performing the request, and the parent process information, providing a granular view of object‑level access that aids forensic correlation and anomaly detection.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"System Integrity" LEFT/RIGHT arrow keys for navigation
Back to List