Event ID - 599

Event Id599
SourceSecurity
DescriptionUnprotection of auditable protected data.
      Data Description: < Data Description>
      Key Identifier: < Key Identifier>
      Protected Data Flags: < Protected Data Flags>
      Protection Algorithms: < Protection Algorithms>
      Failure Reason: < Failure Reason>     

Event InformationAccording to Microsoft :
Cause :
A program used the CryptUnprotectData function to read data encrypted by Data Protection API (DPAPI). The name of the encrypted data is provided in the event message, but because this name is determined by the program that originally created the encrypted data, it might not be recognizable. This event is logged for informational purposes only.

The description field in the message typically, but not always, displays one of the following:

Enterprise Credential Set

This is a set of credentials, stored by Credential Manager in the user's profile, that can roam with the profile.

Local Credential Set
This is a set of credentials, stored by Credential Manager in the user's profile, that cannot roam with the profile.
resolution :
No user action is required.
Reference LinksEvent ID 599 from Source Security

Alternate Event ID in Vista and Windows Server 2008 is 4695.

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.