Are you saving passwords to a keystore file? Look at the paths that the winlogbeat service is trying to use. If you use the .msi install for Winlogbeat, you need to create a C:\Program Files\Elastic\Beats<version number>\winlogbeat\data directory and copy the winlogbeat.keystore file that is in C:\ProgramData\Elastic\Beats\Winlogbeat\data directory to it. If you did a .zip install you need to do something similar but you paths will be different. Hope this fixes your problem.