migs_k 0 Posted April 14, 2021 Share Posted April 14, 2021 (edited) after logging in using PIN after a restart and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\S-1-5-21-229674073-691441657-888200982-1001\NgcFirst\ConsecutiveSwitchCount Quote Time;Application;Operation;Target;Action;Rule;Additional information 4/14/2021 8:44:57 PM;C:\Windows\System32\svchost.exe;Modify startup settings;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\S-1-5-21-229674073-691441657-888200982-1001\NgcFirst\ConsecutiveSwitchCount;allowed;Automatic mode; this came up on ESET HIPS, never seen this popping up before. after doing some internet search, this came up https://forum.eset.com/topic/23588-hips-alert-for-host-process/?_fromLogin=1 Edited April 14, 2021 by migs_k Link to comment Share on other sites More sharing options...
itman 1,659 Posted April 14, 2021 Share Posted April 14, 2021 20 minutes ago, migs_k said: after doing some internet search, this came up https://forum.eset.com/topic/23588-hips-alert-for-host-process/?_fromLogin=1 This thread ended with the issue being related to Eset LiveGrid connectivity. Check your Eset Event log for any entries realted to this status. migs_k 1 Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted April 14, 2021 Administrators Share Posted April 14, 2021 You have this setting probably enabled, it's disabled by default: You can either disable it or disregard the notification. migs_k 1 Link to comment Share on other sites More sharing options...
Recommended Posts