Windows Server Security Event 5377:
Credential Manager credentials were restored from a backup.
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
This event occurs when a user restores his Credential Manager credentials from a backup. A user (even an Administrator) cannot restore the credentials of an account other than his own.