| Event Id | 599 |
| Source | Security |
| Description | Unprotection of auditable protected data. Data Description: < Data Description> Key Identifier: < Key Identifier> Protected Data Flags: < Protected Data Flags> Protection Algorithms: < Protection Algorithms> Failure Reason: < Failure Reason> |
| Event Information | According to Microsoft : Cause : A program used the CryptUnprotectData function to read data encrypted by Data Protection API (DPAPI). The name of the encrypted data is provided in the event message, but because this name is determined by the program that originally created the encrypted data, it might not be recognizable. This event is logged for informational purposes only. The description field in the message typically, but not always, displays one of the following: Enterprise Credential Set This is a set of credentials, stored by Credential Manager in the user's profile, that can roam with the profile. Local Credential Set This is a set of credentials, stored by Credential Manager in the user's profile, that cannot roam with the profile. resolution : No user action is required. |
| Reference Links | Event ID 599 from Source Security Alternate Event ID in Vista and Windows Server 2008 is 4695. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.