Odd activity in Microsoft security events log

Question

Doing some basic computer security self education. Does the code look odd to anybody? I am not on a shared network, I do not use a server and there are no guest profiles.

Event ID 5379:

• <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
• <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
  <EventID>5379</EventID>
  <Version>0</Version>
  <Level>0</Level>
  <Task>13824</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8020000000000000</Keywords>
  <TimeCreated SystemTime="2021-12-01T10:14:22.3122754Z" />
  <EventRecordID>16170</EventRecordID>
  <Correlation ActivityID="{68aadd82-e48c-0002-dbdd-aa688ce4d701}" />
  <Execution ProcessID="756" ThreadID="1088" />
  <Channel>Security</Channel>
  <Computer>computer</Computer>
  <Security />
  </System>
• <EventData>
  <Data Name="SubjectUserSid">S-1-5-21-1116816216-3653774597-1769020264-1001</Data>
  <Data Name="SubjectUserName">NA</Data>
  <Data Name="SubjectDomainName">COMPUTER</Data>
  <Data Name="SubjectLogonId">0xc900d</Data>
  <Data Name="TargetName">WindowsLive:(cert):name=02hyxxuglzvccbuf;serviceuri=*</Data>
  <Data Name="Type">0</Data>
  <Data Name="CountOfCredentialsReturned">0</Data>
  <Data Name="ReadOperation">%%8100</Data>
  <Data Name="ReturnCode">3221226021</Data>
  <Data Name="ProcessCreationTime">2021-12-01T10:14:22.0256001Z</Data>
  <Data Name="ClientProcessId">13328</Data>
  </EventData>
  </Event>

Answer 1

Hello,

Welcome to Microsoft Q&A!

According to Event ID 5379, This is a normal condition. No further action is required.

Thank you.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.