| Details | |
| Product: | Windows Operating System |
| Event ID: | 599 |
| Source: | Security |
| Version: | 5.0 |
| Symbolic Name: | SE_AUDITID_DPAPI_UNPROTECT |
| Message: | Unprotection of auditable protected data. Data Description: %2 Key Identifier: %1 Protected Data Flags: %3 Protection Algorithms: %4 Failure Reason: %5 |
| Explanation | |
|
A program used the CryptUnprotectData function to read data encrypted by Data Protection API (DPAPI). The name of the encrypted data is provided in the event message, but because this name is determined by the program that originally created the encrypted data, it might not be recognizable. This event is logged for informational purposes only. The description field in the message typically, but not always, displays one of the following: Enterprise Credential Set This is a set of credentials, stored by Credential Manager in the user’s profile, that can roam with the profile. Local Credential Set This is a set of credentials, stored by Credential Manager in the user’s profile, that cannot roam with the profile. |
|
| User Action | |
|
No user action is required. |
|