|Product:||Windows Operating System|
|Message:||Unprotection of auditable protected data.
Data Description: %2
A program used the CryptUnprotectData function to read data encrypted by Data Protection API (DPAPI). The name of the encrypted data is provided in the event message, but because this name is determined by the program that originally created the encrypted data, it might not be recognizable. This event is logged for informational purposes only.
The description field in the message typically, but not always, displays one of the following:
Enterprise Credential Set
This is a set of credentials, stored by Credential Manager in the user’s profile, that can roam with the profile.
Local Credential Set
This is a set of credentials, stored by Credential Manager in the user’s profile, that cannot roam with the profile.
No user action is required.