Windows Security Log Event ID 5059
5059: Key migration operation
On this page
Key migration operation
Server 2019 added the Process Information fields.
Free Security Log Resources by Randy
Subject
- Security ID:
- Account Name:
- Account Domain:
- Logon ID:
Process Information (new fields in 2019)
- Process ID:
- Process Creation Time:
Cryptographic Parameters
- Provider Name:
- Algorithm Name:
- Key Name:
- Key Type:
Key File Operation Information
Setup PowerShell Audit Log Forwarding in 4 Minutes
2019
Key migration operation.
Subject:
Security ID: ACME-FR\administrator
Account Name: administrator
Account Domain: ACME-FR
Logon ID: 0x20f9d
Process Information:
Process ID:
Process Creation Time:
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: acme-fr-WIN-857ZZX6RQHL-CA
Key Type: Machine key.
Additional Information:
Operation: Export of persistent cryptographic key.
Return Code: 0x0
2016 and earlier
Key migration operation.
Subject:
Security ID: ACME-FR\administrator
Account Name: administrator
Account Domain: ACME-FR
Logon ID: 0x20f9d
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: acme-fr-WIN-857ZZX6RQHL-CA
Key Type: Machine key.
Additional Information:
Operation: Export of persistent cryptographic key.
Return Code: 0x0
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection