/chrome/a/community?hl=en
This content is likely not relevant anymore. Try searching or browse recent questions.
-
9/27/19
Excessive Windows 10 Audit Failures from chrome.exe 0 Recommended Answers 11 Replies 16 Upvotes
1 Recommended Answer
$0 Recommended Answers
Last edited 12/6/19
Hello,
I have thousands of Audit Failure events (4673) in my local Windows Event Security log. They all are coming from my Google Chrome.

Thousands of Audit Failures from chrome.exe

The computer is WIndows 10 latest feature upgrade. It is a Domain Member, and I use a local user (as opposed to a Domain User) to logon and use it. All apps are installed in this same user context, and I do get the occaisional audit failure when something tries to authenticate/escalate privilege but not thousands, and from chrome no less.
UPDATE:
I run Chrome as Administrator and it has an audit success indicating a permissions change.

Anyone else have this problem? Any solutions out there?
Regards,
lost in audit failures
All Replies (11)
10/2/19
Would you mind posting

1) contents of chrome://version
2) a screenshot of some of the Audit Failure events from Windows Event Security log?  Please remove any sensitive information.

That will help us debug.
Thanks!
marked this as an answer
Helpful?
11/2/19
I am seeing the same event logging on every machine I've checked. I have a laptop that is Windows 10 Enterprise 1903 build and domain joined as well as a home PC with Windows 10 1903. I just updated Chrome to 78.0.3904.87. On the laptop I cleared my security event log and launched Chrome to https://www.google.com homepage. It immediately logged 1,343 audit failures Event ID 4673 just like this:

Service:
Server: Security
Service Name: -

Process:
Process ID: 0x13170
Process Name: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Service Request Information:
Privileges: SeProfileSingleProcessPrivilege

The 'Process ID:' number changes but all other info remains the same. This is absolutely flooding event logs and making them useless for troubleshooting. We need a resolution quickly please.
marked this as an answer
Helpful?
11/3/19
Please file a https://crbug.com/new and our engineers will look into it.
Note that we are not seeing this from any other customers.

BTW - are you using an AV(Anti-Virus), who is the vendor?
marked this as an answer
Helpful?
11/4/19
On my laptop, the A/V is Symantec Endpoint Protection. My home PC is just running the included Windows Defender A/V.
marked this as an answer
Helpful?
11/4/19
Would you mind looking through this bug to see if your issues are related to this? http://crbug/993099
marked this as an answer
Helpful?
11/14/19
Any more info on this?  We're running into what appears to be the same issue. We noticed a ton of 4673 events. We're running latest Chrome (Version 78.0.3904.97 (Official Build) (64-bit)), SEP 14.2.4814.1101. The workarounds in 993099 didn't appear to make a difference.
marked this as an answer
Helpful?
12/6/19
Any updates on this issue? Should we change our security policies, or should you remove single process profiling actions?
marked this as an answer
Helpful?
12/11/19
I have turned on System Event Log monitor looking for 4625 - Seeing Chrome Across the board on numerous Desktops.   

4625 was Turned on as it's the basic step in fighting Cyber Crime and someone trying to Hack into a computer.


See below.....

Logon Type: 2

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Owner
Account Domain: DESKTOP-O9L28U0

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006E
Sub Status: 0xC000006E

Process Information:
Caller Process ID: 0x290c
Caller Process Name: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
marked this as an answer
Helpful?
12/13/19
I'm receiving over 25,000 events per hour with EventID 4673 caused by Chrome. I do have a couple dozen tabs open across 3 windows, I haven't tested if that makes a difference. These are polluting my event logs. Same as above (scrubbed):

A privileged service was called.

Subject:
Security ID: DOMAIN\account
Account Name: account
Account Domain: DOMAIN
Logon ID: 0xDEADBEE

Service:
Server: Security
Service Name: -

Process:
Process ID: 0x34e8
Process Name: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Service Request Information:
Privileges: SeProfileSingleProcessPrivilege
marked this as an answer
Helpful?
12/31/19
Same issue here. I have filed https://crbug.com/1038507 about this behavior.
marked this as an answer
Helpful?
12/31/19
Any updates - Same thing here - We are using an RMM tool and added this event to monitor and then we got a huge amount of alerts from about 500 windows computers.   Is Chrome a virus?
marked this as an answer
Helpful?
This question is locked and replying has been disabled.
Discard post? You will lose what you have written so far.
Write a reply
10 characters required
Failed to attach file, click here to try again.
Discard post?
You will lose what you have written so far.
Personal information found

We found the following personal information in your message:

This information will be visible to anyone who visits or subscribes to notifications for this post. Are you sure you want to continue?

A problem occurred. Please try again.
Create Reply
Edit Reply
Delete post?
This will remove the reply from the Answers section.
Notifications are off
Your notifications are currently off and you won't receive subscription updates. To turn them on, go to Notifications preferences on your Profile page.
Report abuse
Google takes abuse of its services very seriously. We're committed to dealing with such abuse according to the laws in your country of residence. When you submit a report, we'll investigate it and take the appropriate action. We'll get back to you only if we require additional details or have more information to share.

Go to the Legal Help page to request content changes for legal reasons.

Reported post for abuse
Unable to send report.
Report post
Questions about a different Google product are no longer considered off-topic and should be moved to the relevant community.
Google takes abuse of its services very seriously. We're committed to dealing with such abuse according to the laws in your country of residence. When you submit a report, we'll investigate it and take the appropriate action. We'll get back to you only if we require additional details or have more information to share.

Go to the Legal Help page to request content changes for legal reasons.

Reported post for abuse
Unable to send report.
This reply is no longer available.
/chrome/a/threads
//accounts.google.com/ServiceLogin
You'll receive email notifications for new posts at
Unable to delete question.
Unable to update vote.
Unable to update subscription.
You have been unsubscribed
Deleted
Unable to delete reply.
Removed from Answers
Marked as Recommended Answer
Removed recommendation
Undo
Unable to update reply.
Unable to update vote.
Thank you. Your response was recorded.
Unable to undo vote.
Thank you. This reply will now display in the answers section.
Link copied
Locked
Unlocked
Unable to lock
Unable to unlock
Pinned
Unpinned
Unable to pin
Unable to unpin
Marked
Unmarked
Unable to mark
Reported as off topic
/chrome/a/profile/0?hl=en