Windows Event ID 5061 – Microsoft-Windows-Security-Auditing: Cryptographic Operation Failed

Start by examining the specific details of Event ID 5061 to understand the exact nature of the cryptographic failure.

1. Open Event Viewer by pressing Windows + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5061 by right-clicking the Security log and selecting Filter Current Log
4. Enter 5061 in the Event IDs field and click OK
5. Double-click on recent Event ID 5061 entries to view detailed information
6. Note the following key details from the event description:
   • Subject name and process information
   • Cryptographic operation type
   • Error code and failure reason
   • Certificate thumbprint or algorithm details
7. Use PowerShell to extract detailed event information:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5061} -MaxEvents 10 | ForEach-Object {
    [xml]$xml = $_.ToXml()
    $xml.Event.EventData.Data | ForEach-Object {
        Write-Host "$($_.Name): $($_.'#text')"
    }
    Write-Host "---"
}

Verify the integrity and validity of certificates in the Windows certificate stores, as corrupted or expired certificates are common causes of Event ID 5061.

1. Open the Microsoft Management Console by pressing Windows + R, typing mmc, and pressing Enter
2. Add the Certificates snap-in: File → Add/Remove Snap-in → Certificates → Add
3. Select Computer account and Local computer, then click Finish
4. Expand Certificates (Local Computer) and check these key stores:
   • Personal → Certificates
   • Trusted Root Certification Authorities
   • Intermediate Certification Authorities
5. Look for expired certificates (red X icon) or certificates with validation issues
6. Use PowerShell to check certificate validity programmatically:

# Check for expired certificates in Personal store
Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.NotAfter -lt (Get-Date)
} | Select-Object Subject, NotAfter, Thumbprint

# Check certificate chain validation
Get-ChildItem Cert:\LocalMachine\My | ForEach-Object {
    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
    $result = $chain.Build($_)
    if (-not $result) {
        Write-Host "Certificate validation failed: $($_.Subject)"
        $chain.ChainStatus | ForEach-Object {
            Write-Host "  Error: $($_.Status) - $($_.StatusInformation)"
        }
    }
}

Check the health and configuration of Cryptographic Service Providers (CSPs) that handle cryptographic operations in Windows.

1. Open Command Prompt as Administrator
2. List available CSPs and their status:

certlm.msc

3. Use PowerShell to check CSP functionality:

# List installed CSPs
Get-WmiObject -Class Win32_EncryptableVolume -Namespace root\cimv2\security\microsoftvolumeencryption

# Check CryptoAPI CSP status
$cspList = @(
    "Microsoft Base Cryptographic Provider v1.0",
    "Microsoft Enhanced Cryptographic Provider v1.0",
    "Microsoft Strong Cryptographic Provider"
)

foreach ($csp in $cspList) {
    try {
        $provider = New-Object System.Security.Cryptography.CspParameters
        $provider.ProviderName = $csp
        $rsa = New-Object System.Security.Cryptography.RSACryptoServiceProvider($provider)
        Write-Host "CSP '$csp': OK"
        $rsa.Dispose()
    } catch {
        Write-Host "CSP '$csp': FAILED - $($_.Exception.Message)"
    }
}

Get-Service -Name "CryptSvc" | Select-Object Name, Status, StartType
Restart-Service -Name "CryptSvc" -Force

# Check CSP registry entries
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\*" | Select-Object PSChildName, Image

regsvr32 /s cryptdlg.dll
regsvr32 /s cryptui.dll
regsvr32 /s initpki.dll

Identify and resolve cryptographic failures specific to applications or services that are generating Event ID 5061.

1. Correlate Event ID 5061 with application events by checking the process information in the security event
2. Use Process Monitor to track file and registry access during cryptographic operations:

# Download and run Process Monitor (ProcMon) to capture cryptographic operations
# Filter by Process Name matching the application from Event ID 5061

3. Check application-specific certificate stores and configurations:

# For IIS applications
Import-Module WebAdministration
Get-WebBinding | Where-Object {$_.protocol -eq "https"} | ForEach-Object {
    $cert = Get-ChildItem Cert:\LocalMachine\My\$($_.certificateHash)
    if ($cert.NotAfter -lt (Get-Date)) {
        Write-Host "Expired certificate for site: $($_.ItemXPath)"
    }
}

# For SQL Server applications
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\*\MSSQLServer\SuperSocketNetLib" -Name Certificate -ErrorAction SilentlyContinue

# Look for related application events around the same time as Event ID 5061
$timeRange = (Get-Date).AddHours(-2)
Get-WinEvent -FilterHashtable @{
    LogName='Application','System'
    Level=1,2,3
    StartTime=$timeRange
} | Where-Object {$_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Warning"} | 
Sort-Object TimeCreated | Select-Object TimeCreated, LogName, Id, LevelDisplayName, Message

# Check SSL protocols and cipher suites
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\*\*" | 
Select-Object PSPath, Enabled, DisabledByDefault

# Test certificate-based authentication
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*YourAppName*"}
if ($cert) {
    try {
        $rsa = $cert.PrivateKey
        $testData = [System.Text.Encoding]::UTF8.GetBytes("test")
        $signature = $rsa.SignData($testData, [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
        Write-Host "Certificate signing test: PASSED"
    } catch {
        Write-Host "Certificate signing test: FAILED - $($_.Exception.Message)"
    }
}

Perform comprehensive PKI infrastructure analysis and remediation for complex cryptographic failures affecting multiple systems or services.

1. Analyze Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) connectivity:

# Test CRL and OCSP endpoints
$certs = Get-ChildItem Cert:\LocalMachine\My
foreach ($cert in $certs) {
    $extensions = $cert.Extensions | Where-Object {$_.Oid.FriendlyName -eq "CRL Distribution Points"}
    if ($extensions) {
        Write-Host "Certificate: $($cert.Subject)"
        Write-Host "CRL URLs: $($extensions.Format($false))"
        
        # Test CRL accessibility
        $crlUrls = $extensions.Format($false) -split "`n" | Where-Object {$_ -match "http"}
        foreach ($url in $crlUrls) {
            try {
                $response = Invoke-WebRequest -Uri $url.Trim() -TimeoutSec 10
                Write-Host "  CRL accessible: $($url.Trim()) - Status: $($response.StatusCode)"
            } catch {
                Write-Host "  CRL inaccessible: $($url.Trim()) - Error: $($_.Exception.Message)"
            }
        }
    }
}

# Check domain controller certificates
Get-ADDomainController -Filter * | ForEach-Object {
    $dcName = $_.Name
    Write-Host "Checking DC: $dcName"
    
    try {
        $cert = Invoke-Command -ComputerName $dcName -ScriptBlock {
            Get-ChildItem Cert:\LocalMachine\My | Where-Object {
                $_.Subject -like "*$env:COMPUTERNAME*" -and $_.HasPrivateKey
            }
        }
        
        if ($cert.NotAfter -lt (Get-Date).AddDays(30)) {
            Write-Host "  WARNING: Certificate expires soon on $dcName"
        }
    } catch {
        Write-Host "  ERROR: Cannot check certificate on $dcName"
    }
}

# Check time synchronization (critical for certificate validation)
w32tm /query /status
w32tm /query /peers

# Compare local time with domain controller
$dcTime = Invoke-Command -ComputerName (Get-ADDomainController).Name -ScriptBlock {Get-Date}
$localTime = Get-Date
$timeDiff = ($localTime - $dcTime).TotalSeconds

if ([Math]::Abs($timeDiff) -gt 300) {
    Write-Host "WARNING: Time difference with DC is $timeDiff seconds (threshold: 300s)"
    Write-Host "Run: w32tm /resync /force"
}

# Clear certificate cache and rebuild chains
CertLM.msc
# Or via command line:
certutil -pulse
certutil -generateSSTFromWU roots.sst
certutil -addstore -f root roots.sst

# Check relevant Group Policy settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -ErrorAction SilentlyContinue

# Create detailed cryptographic infrastructure report
$report = @{}
$report.Timestamp = Get-Date
$report.ComputerName = $env:COMPUTERNAME
$report.Certificates = Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter, HasPrivateKey, Thumbprint
$report.ExpiredCerts = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.NotAfter -lt (Get-Date)}
$report.CryptoServices = Get-Service -Name "CryptSvc","BITS","EventLog" | Select-Object Name, Status
$report.RecentCryptoEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5061; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue

$report | ConvertTo-Json -Depth 3 | Out-File "C:\temp\CryptoHealthReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"