Solved Why is a Security Audit running so much

There was an incident where I was moving my cursor and it stopped for a second and then resumed. Curious, I opened the event log. I could find nothing noteworthy in Applications or System. However, when I opened Security I found that an audit was running multiple times every second. I have not seen this before. Does anyone know why something like this would occur? I also found multiples of this:

Subject:
Security ID: BOBS-PC\Bob
Account Name: Bob
Account Domain: BOBS-PC
Logon ID: 0x5215B

User:
Security ID: BOBS-PC\Guest
Account Name: Guest
Account Domain: BOBS-PC

Does this mean that there's activity on a Guest ID (I have Guest disabled in GPEDIT)?

That's normal, it audits multiple things in batches, at intervals or on demand, its basically the credential manager.

Never noticed this before. Seems like overkill running 20-25 times each minute. Only noticed after updating OS to 26100.3775.

rzn6jw said:

Never noticed this before. Seems like overkill running 20-25 times each minute. Only noticed after updating OS to 26100.3775.

Click to expand...

It's been doing this for ages. I got Windows to suppress the audit success with this command (run Powershell/Terminal as Admin):

Auditpol /set /subcategory:"User Account Management" /success:disable

That seemed to do it. Thanks for your help. Quick question, does the command stay permanent until you issue another or does it change back on boot/reboot?

rzn6jw said:

That seemed to do it. Thanks for your help. Quick question, does the command stay permanent until you issue another or does it change back on boot/reboot?

Click to expand...

It stays, not sure what will happen after a Windows update but reboots etc is fine