Event ID 5061 is one of the noisiest events in the Windows Security log, yet it holds real value for monitoring cryptographic key usage. It records every cryptographic operation performed through a Key Storage Provider, from routine key opens to sensitive key deletions. Understanding its fields, and knowing which entries are benign boot-time noise, is the difference between drowning in log volume and catching genuine key abuse.
Key takeaways
- Event 5061 logs cryptographic operations performed through a Key Storage Provider (KSP).
- It only generates for the Microsoft Software or Smart Card KSP, in the Audit System Integrity subcategory.
- Boot-time failures with Return Code 0x80090016 are common and usually benign.
- It's most useful when filtered for specific Key Names, Delete Key operations, or unexpected accounts.
Quick explanation
In simple terms
Event ID 5061 is a Windows log entry that records when a program uses a cryptographic key through the system's key storage service.
Technical definition
Event ID 5061 (S, F) is a Windows Security Auditing event in the Audit System Integrity subcategory, generated when a cryptographic operation is performed via the Microsoft Software or Smart Card Key Storage Provider (KSP), capturing the subject, key parameters, operation, and return code.
Analogy
Think of a KSP as a bank vault for cryptographic keys. Event 5061 is the vault's access log, recording every time someone opens, uses, or removes a key, along with whether they succeeded.
Definition
A Windows security audit event logging cryptographic operations performed through a Key Storage Provider.
Event ID 5061 is a Windows Security Auditing event generated when a cryptographic operation is performed through a Key Storage Provider (KSP). Per Microsoft Learn, it belongs to the Audit System Integrity subcategory and only generates when the Microsoft Software Key Storage Provider or Microsoft Smart Card Key Storage Provider is used.
The event captures the Subject (which account requested the operation), the Cryptographic Parameters (provider, algorithm, key name, and key type), the Operation (such as Open Key, Create Key, Delete Key, Sign, or Encrypt), and the Return Code showing success or failure. It appears in both Success (S) and Failure (F) variants.
Because key operations happen constantly, Event 5061 is high-volume. Much of it is benign, including the well-known boot-time failures with Return Code 0x80090016. Its security value comes from filtering for specific keys, sensitive operations, or unexpected accounts.
Why it matters
Core concepts
Key Storage Provider (KSP)
A software component that manages the storage and use of cryptographic keys.
A Key Storage Provider (KSP) is the CNG (Cryptography Next Generation) component that stores and performs operations with cryptographic keys. Per Microsoft Learn, Event 5061 generates only when one of two KSPs is used: the Microsoft Software Key Storage Provider or the Microsoft Smart Card Key Storage Provider.
The KSP handles operations like opening, creating, and deleting keys, plus signing, encryption, and decryption. When any of these operations occurs through a monitored KSP, Windows logs Event 5061 (if System Integrity auditing is enabled).
Example
Microsoft Software Key Storage Provider handling an RSA key for TLS.
Why it matters — The KSP is the boundary where key operations happen. Monitoring it reveals which accounts use which keys for what purpose.
The Operation Field
The specific cryptographic action being performed on a key.
The Operation field identifies what the KSP did. Per Microsoft Learn, operations include Open Key, Create Key, Delete Key, Key Import, Encrypt, Decrypt, Sign, and Verify.
Most operations are routine (Open Key dominates the log volume). Some are security-relevant: Delete Key on a certificate's private key could indicate tampering, and Key Import may signal a new key being introduced. The event also includes an Operation Code and a Return Code showing whether the operation succeeded.
Example
Operation: Open Key with Return Code 0x0 (success) or 0x80090016 (key not found).
Why it matters — The Operation distinguishes benign key reads from sensitive actions like key deletion or import, letting you focus alerts on what matters.
The Return Code
A hexadecimal status code indicating whether the cryptographic operation succeeded or failed.
The Return Code shows the result of the operation. 0x0 means success. Per Microsoft Q&A, the most common failure code is 0x80090016, which means the key storage service couldn't access the key, often because the key doesn't exist, is corrupted, or the account lacks permission.
At every reboot, accounts like LOCAL SERVICE and SYSTEM often generate 5061 failures with 0x80090016 while trying to open keys that don't exist yet (like the Microsoft Connected Devices Platform device certificate). These are usually benign and can flood the log.
Example
Return Code: 0x80090016 for LOCAL SERVICE opening a missing device certificate at boot.
Why it matters — The Return Code separates successful operations from failures. Recognizing benign boot-time 0x80090016 failures prevents wasted investigation.
Cryptographic Parameters
Metadata describing the key involved in the operation.
The Cryptographic Parameters group describes the key. Per Microsoft Learn, it includes the Provider Name (the KSP, e.g., Microsoft Software Key Storage Provider), the Algorithm Name (e.g., RSA, or UNKNOWN when unavailable), the Key Name (an identifier or GUID), and the Key Type.
The Key Type is either a User key (tied to a specific user profile) or a Machine key (available system-wide). This distinction matters for understanding scope: a machine key operation affects the whole system, while a user key is limited to that user's context.
Example
Provider: Microsoft Software Key Storage Provider, Algorithm: RSA, Key Type: Machine key.
Why it matters — These parameters identify exactly which key was used, enabling monitoring of specific sensitive keys by name or type.
How it works
An Application Requests a Key Operation
An application or service calls the CNG API to perform a cryptographic operation, such as opening a key for signing or decrypting data.
Application requests key operation
Example — A TLS service opens its RSA private key to establish a connection.
The KSP Handles the Operation
The request routes to a Key Storage Provider. Per Microsoft Learn, Event 5061 only generates for the Microsoft Software or Smart Card KSP.
KSP handles the operation
Example — The Microsoft Software Key Storage Provider processes the Open Key request.
The Operation Completes
The KSP performs the operation and returns a result code (0x0 for success, or an error like 0x80090016).
Operation succeeds or fails
Example — The key is opened successfully (0x0), or not found (0x80090016).
Windows Logs the Event
If Audit System Integrity is enabled, Windows writes Event 5061 to the Security log with the Subject, Cryptographic Parameters, Operation, and Return Code.
Event 5061 logged
Example — A 5061 Success or Failure event appears in Event Viewer under System Integrity.
Examples
Benign Boot-Time Failures
Boot-time audit failures with 0x80090016
At boot, LOCAL SERVICE and SYSTEM accounts attempt to open cryptographic keys that don't exist yet, such as the Microsoft Connected Devices Platform device certificate. Per Microsoft Q&A, these generate 5061 failures with Return Code 0x80090016. This is expected behavior on many Windows 10/11 systems and typically requires no action.
Detecting Key Deletion
Alerting on Delete Key for a protected key
A monitoring rule watches Event 5061 for Operation: Delete Key on high-value Key Names (like a code-signing or LDAPS server certificate key). Per Microsoft Learn, this event is well-suited to detailed monitoring of specific keys. An unexpected Delete Key on a protected key triggers an alert for investigation.
Diagnosing Key Access Failures
Application service failing to access its key
A server logs repeated 5061 events with Operation: Open Key and Return Code 0x80090016 for a specific application service account. This points to a permissions or key access problem: the account can't reach a key it needs. Per Microsoft Q&A, 0x80090016 indicates the keystore can't access the key normally, prompting a check of key permissions and store integrity.
Practical implications
For admins
Recognize benign boot-time 5061 failures (0x80090016 from LOCAL SERVICE/SYSTEM) to avoid chasing non-issues. Use the event to diagnose real key access failures affecting applications.
For MSPs
Build tuned detection rules that exclude boot-time noise while alerting on sensitive operations, so client SIEMs aren't overwhelmed by 5061 volume.
For business
Cryptographic key monitoring supports compliance requirements around key management and access control, providing an audit trail of key operations.
For security
Event 5061 is a data source for detecting cryptographic key abuse: unexpected Delete Key, Key Import, or key access by unusual accounts. Filter aggressively to make it actionable.
Decision guide
Use when
- Monitoring access to specific sensitive cryptographic keys by name
- Detecting suspicious Delete Key or Key Import operations
- Investigating certificate or key store failures showing 0x80090016
Avoid when
- You can't tolerate high log volume and lack filtering or SIEM capacity
- You only need certificate issuance auditing (use AD CS logs instead)
- The environment doesn't use the Microsoft Software or Smart Card KSP
Requirements
- Audit System Integrity subcategory enabled (Success and/or Failure)
- SIEM or log filtering to manage high event volume
- A baseline of normal key operations to spot anomalies
Alternatives
- Event 5058 for key file operations (read, write, delete of persisted key files)
- Event 4673/4674 for privileged service and object operations
- PKI and certificate lifecycle logging via AD CS auditing
Related terms
CNG (Cryptography Next Generation)
The Cryptography Next Generation API in Windows that provides cryptographic services, including Key Storage Providers.
Event ID 5058
A companion event that logs key file operations (read, write, delete, export) on persisted cryptographic key files.
Audit System Integrity
The audit policy subcategory that controls logging of events affecting the integrity of the security subsystem, including cryptographic operations.
Security Identifier (SID)
A unique variable-length value that identifies a security principal (user, group, or computer) in Windows.
Key Type
A distinction in the event indicating whether a key is tied to a specific user profile (User key) or available system-wide (Machine key).
Frequently asked questions
What triggers Event ID 5061?
Per Microsoft Learn, it generates when a cryptographic operation (open, create, delete, sign, encrypt, decrypt) is performed using the Microsoft Software Key Storage Provider or Microsoft Smart Card Key Storage Provider, with Audit System Integrity enabled.
Is Event 5061 with 0x80090016 a problem?
Usually yes. Per Microsoft Q&A, boot-time 5061 failures with Return Code 0x80090016 from accounts like LOCAL SERVICE trying to open non-existent keys (such as device certificates) are expected and typically benign.
What does the Return Code mean?
0x0 means success. 0x80090016 is the most common failure, meaning the key storage service couldn't access the key, often because it doesn't exist, is corrupted, or the account lacks permission.
How should I monitor Event 5061?
Filter to reduce volume: exclude benign boot-time failures, and alert on specific Key Names, sensitive Operations like Delete Key, or unexpected Subject accounts. Enable the Audit System Integrity subcategory to capture it.
What is the difference between Event 5061 and 5058?
5061 covers cryptographic operations through a KSP (open, sign, encrypt keys). 5058 covers key file operations (read, write, delete, export of the persisted key file). They complement each other for full key lifecycle monitoring.
Conclusion
Event ID 5061 logs cryptographic operations (open, create, delete, sign, encrypt) performed through a Key Storage Provider, specifically the Microsoft Software or Smart Card KSP. Per Microsoft Learn, it belongs to the Audit System Integrity subcategory.
The event is high-volume and frequently benign. The common 0x80090016 failure at boot, tied to accounts like LOCAL SERVICE trying to open a missing key, is usually noise. The event becomes useful when you filter for specific Key Names, sensitive Operations like Delete Key, or unexpected Subject accounts.
Main takeaway
When building SIEM detection rules for cryptographic key abuse or investigating certificate and key store issues.
-640x640.webp&w=3840&q=75)