Incessant "Audit Success" (EventID 4798) accompanied by sound

Topic

New Reply

[PKCano]

Hello All,

here’s a strange one (to me at least).

• Windows 10 Home 64bit (1803; yes I know, but that’s not the strange bit)

Completely out of the blue*, my computer started to frequently play the “device disconnected” system sound, usually in series, with an interval of only a few seconds.
This is unrelated to any activity and happens even when I am not doing anything at all on the machine.
* no addition or changes in hardware, software, configuration, or usage,
no Win10 updates (I know of…))

I found that this is connected to whole series of “EventID 4798” entries being generated all the time, sometimes within seconds of each other, and each one (now) apparently also triggering the sound. There may then be a pause for several minutes, then another series starts, with intervals of a few seconds only.
EventID 4798 is “Microsoft Windows security auditing / User account Management / Audit Success: A user’s local group membership was enumerated”

There are three problems with this:

1. huge numbers of entries in the Event Viewer’s System log
   (worrying but perhaps not a real problem)
2. accompanying system sound (“device disconnected“) every time
   (disconcerting and highly disturbing)
3. possibly interruption (for a second or so) of ongoing work (“cursor freezing”) with each such event.
   I have not yet observed this myself (the problem just started) but saw it in reports from other people on various web sites. (Apparently the issue has thus been observed by others, too, but unfortunately no suggestions for a solution are given).

My questions:

• What exactly does this “audit” do?
  The computer in question has only one single account (mine) with admin rights. And I have no idea what those “local groups” might be.
  (Does this even apply to Win10 Home? I know it does not have group policies. So what exactly is there to “enumerate”?)
• Is it normal that so many “audits” are conducted (and thus log entries generated)?
  (I discovered that even before the sound disturbance set in, dozens if not hundreds per day seem to have happened, but they remained unnoticed.)
• Why does this audit all of a sudden also play a sound?
• How can the sound be suppressed?
• If possible/advisable: How can the number of audits be reduced?
• Or if all fails, can these audits be completely disabled?
  (E.g. by setting some service to “manual” etc.)
• Or is this actually the other way round and after all an USB device issue (as indicated by the “Device disconnected sound“), which only triggers Event 4798, and thus the problem has to be investigated on the USB side?

“Technical” advice (such as e.g. Registry fiddling) or info are also welcome; I have an IT background. It’s just that the inner workings of Win10 go beyond my horizon…

Thanks in advance for any tips or pointers.

• This topic was modified 5 years, 7 months ago by PKCano.
• This topic was modified 5 years, 7 months ago by WShagen.

Reply | Quote

Replies

I have Googled the EventID and found something on TenForums that might help. On the second page, the poster unplugs his mouse and replaces it with another. Perhaps one of the peripheral devices (mouse, keyboard, any plug-in) is failing. Try swapping things out and see if that’s the case.

If you find that to be the case, you might try updating the driver for the device.

It would also help us to know what Build of 1803 you are on and when you did the last updating (KB # of patches, any drivers?). MS has a sneaky way of installing their drivers in place of the ones there.

Reply | Quote

[WShagen]

Thanks!
(I had in fact seen that post, too, but somehow not yet applied to my issue.)

However, I was just going to update my post above:

Following up on my own last bullet point above, I had the idea to run and monitor USBDeview, but whenever that sound is played,  the changes are too fast to see them in that application.

However, I then set up USBDeview to open some other small application every time a device disconnects, and that is indeed happening.

So apparently the last bullet item does apply and it is a USB issue, with the Event 4798 merely a secondary consequence.

What I am wondering now: How can a device incessantly disconnect (often multiple times within a few seconds) but never re-connect? At least I never get to hear the “device connected” sound…

Anyhow, I’ll now follow your advice and go through the USB devices one by one.
(Perhaps I can even manage to get USBDeview to tell me which one it is; I tried the “showMessage”  option, but that doesn’t do anything; hence the trick to start a small application. Perhaps it doesn’t work under Win10, or it must be started from the command line for this.)

Thanks again for the prompt reply.

Oh, and the version is 10.0.17134 Build 17134.

It’s a new machine, and I have so far held off any updates. At least the “Update History” does not admit to any recent ones, but that does of course not necessarily mean there haven’t been any. The problem at hand started only yesterday… I’ll try to  investigate that aspect, too.

• This reply was modified 5 years, 7 months ago by WShagen.

Reply | Quote

See if MS has changed the driver for a device (included in the last update, but you won’t see it in Update History. You will have to look in Device Manager). Look for an updated device driver from the computer OEM if you find something.

Reply | Quote

Just to close this case (for the benefit of the generations after us who might read this thread):

I set up USBDeview (one of the many blessings from NirSoft) to run a simple batch file in order to log whenever an USB device connects or disconnects, and to tell which one it is. The USB mouse turned out to be the culprit.

In fact, the problem of USB mice rapidly dis- and re-connecting all the time seems to be quite frequent. The standard advice is to disable the Power Management option “Allow the computer to turn off this device to save power” (details can be found e.g. here). But in my case that didn’t help. So I had to resort to the highly sophisticated solution of replacing the mouse by another one. That did the trick (which is good news in a way: a broken mouse is better than a broken USB system on the box).

Thus, another day fruitfully spent. And (off topic) in the proceedings I discovered by chance that I (or my computer) are the unwitting subject of some kind of “Sleep Study” which Microsoft seems to be conducting; I found over 1000 (one thousand) files (*.etl) in a folder thus named (under \Windows\System32).
The fun with Windows and grappling with MS just never ends. No need to actually use the computer for anything when we can just as well spend all the time just administering it and trying to keep control…

Thanks again to PKCano for the support.

 

Reply | Quote

Same problem build 1909

Tried the NirSoft App, but no USB connect disconnect.
Also tried changing mouse and keyboard, still happend

The event is normal (It happends in my Work PC)
but in my home PC this event causes my PC to Ffreeze

Reply | Quote

If you are not getting USB connects then it may be some other issue.
Freezing PC either sounds like out of system resources (open Task Manager > Performance) or a hardware fault.

When did it start happening?
Any updates / new hardware just before it started?

cheers, Paul

Reply | Quote

Had the same problem. New installation of my computer. Forgot to install the Logitech software for my G402 mouse. Did that after reading here, and the sounds went away.

Reply | Quote

Same problem – I plugged in my Logitech headphones and was greeted by about a barrage of USB device plug/unplug event sounds. Checked Event Viewer and saw a ton of event 4798 – stopped after about 1 minute. Appears to be related to the headphone drivers.

Reply | Quote

Looks like updating the mouse firmware kind of did it for me. It’s happening a lot less but still happening so I guess time to get a new mouse

 

Reply | Quote