#credential-manager

2 articles

Windows Events2

Windows security monitoring dashboard showing credential manager events and security logs

Windows Event ID 5376 – Microsoft-Windows-Security-Auditing: Credential Manager Credentials Were Backed Up

Event ID 5376 fires when Windows Credential Manager credentials are backed up to a file or external location, indicating potential security activity that requires monitoring.

March 1812 min

Windows security monitoring dashboard displaying credential access events and audit logs

Event 5615

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 5615 – Security: Credential Manager Vault Access

Event ID 5615 logs when a user or process accesses the Windows Credential Manager vault to retrieve stored credentials, passwords, or certificates for authentication purposes.

March 1812 min