Event ID 5377
Credential Manager credentials were restored from a backup.Credential Manager credentials were restored from a backup.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
This event occurs when a user restores his Credential Manager credentials from a backup. A user (even an Administrator) cannot restore the credentials of an account other than his own.This event generates every time the user (Subject) successfully restores the credential manager database. Typically this can be done by clicking “Restore Credentials” in Credential Manager in the Control Panel.
This event generates on domain controllers, member servers, and workstations.
Auditing:
Always
This event should be recorded for all local and domain accounts, because this action (restore Credential Manager credentials from a backup) is very rarely used by users, and can indicate a virus, or other harmful or malicious activity.
Volume:
Low
This event has a Low expected volume.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"User Account Management"
LEFT/RIGHT arrow keys for navigation
Back to List