Windows Event ID 5377: Credential Manager credentials were restored from backup
Windows Security Event ID 5377 records successful restore of the user Credential Manager database from backup.
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
This event is generated when the Subject successfully restores the Credential Manager database, typically through the Credential Manager control-panel workflow.
Key Fields
SubjectUserName / SubjectDomainName
Identifies the account that performed the restore operation. Microsoft documents that this is the Subject account.
SubjectLogonId
Hexadecimal logon ID that correlates the restore to the user logon session and nearby process creation.
Computer
Identifies whether the restore occurred on a domain controller, member server, or workstation; Microsoft documents that the event can occur on all three.
Common False Positives
- Legitimate restore through Credential Manager can occur during user migration or device replacement.
- Administrative support activity may restore user credentials with the user present, but it should have a ticket.
Related Events
MITRE ATT&CK Mapping
- T1555.004Credentials from Password Stores: Windows Credential Manager
Detection Notes
Use threshold=1 occurrence because Microsoft states every 5377 should be recorded and that restoring Credential Manager credentials is very rarely used and can indicate malicious activity. MITRE T1555.004 notes that Credential Manager backup and restoration can be reached through rundll32.exe keymgr.dll KRShowKeyMgr; a restore followed by 4624 access to network resources can indicate imported credentials. Correlate SubjectLogonId to 4688 and validate the user migration ticket.
SecurityEvent
| where EventID == 5377
| project TimeGenerated, Computer, Accountindex=wineventlog EventCode=5377 | table _time, hostEventID: 5377
SubjectUserName: j.smith
SubjectDomainName: CORP
SubjectLogonId: 0x30d7c
Computer: WS-042