| Event Id | 5377 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | Credential Manager credentials were restored from a backup. Subject: Security ID: <Security ID> Account Name: <Account Name> Account Domain:<Domain Name> Logon ID:<Logon ID> |
| Event Information | Cause : This event occurs when a user restores his Credential Manager credentials from a backup. A user (even an Administrator) cannot restore the credentials of an account other than his own. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.