Unprotection of auditable protected data. Data Description: %2 Key Identifier: %1 Protected Data Flags: %3 Protection Algorithms: %4 Failure Reason: %5

Details
Product: Windows Operating System
Event ID: 599
Source: Security
Version: 5.0
Symbolic Name: SE_AUDITID_DPAPI_UNPROTECT
Message: Unprotection of auditable protected data. Data Description: %2 Key Identifier: %1 Protected Data Flags: %3 Protection Algorithms: %4 Failure Reason: %5
   
Explanation

A program used the CryptUnprotectData function to read data encrypted by Data Protection API (DPAPI). The name of the encrypted data is provided in the event message, but because this name is determined by the program that originally created the encrypted data, it might not be recognizable. This event is logged for informational purposes only.

The description field in the message typically, but not always, displays one of the following:

Enterprise Credential Set

This is a set of credentials, stored by Credential Manager in the user’s profile, that can roam with the profile.

Local Credential Set

This is a set of credentials, stored by Credential Manager in the user’s profile, that cannot roam with the profile.

   
User Action

No user action is required.

Related:

Leave a Reply