4719(S): System audit policy was changed.
Subcategory: Audit Policy Change
Event Description:
This event generates when the computer's audit policy changes.
This event is always logged regardless of the "Audit Policy Change" sub-category setting.
Note For recommendations, see Security Monitoring Recommendations for this event.
Event XML:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4719</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13568</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-09-30T19:57:09.668217100Z" />
<EventRecordID>1049418</EventRecordID>
<Correlation />
<Execution ProcessID="516" ThreadID="4668" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">DC01$</Data>
<Data Name="SubjectDomainName">CONTOSO</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="CategoryId">%%8274</Data>
<Data Name="SubcategoryId">%%12807</Data>
<Data Name="SubcategoryGuid">{0CCE9223-69AE-11D9-BED3-505054503030}</Data>
<Data Name="AuditPolicyChanges">%%8448, %%8450</Data>
</EventData>
</Event>
Required Server Roles: None.
Minimum OS Version: Windows Server 2008, Windows Vista.
Event Versions: 0.
Field Descriptions:
Subject:
- Security ID [Type = SID]: SID of account that made a change to local audit policy. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
Note A security identifier (SID) is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see Security identifiers.
Account Name [Type = UnicodeString]: the name of the account that made a change to local audit policy.
Account Domain [Type = UnicodeString]: subject’s domain or computer name. Formats vary, and include the following:
Domain NETBIOS name example: CONTOSO
Lowercase full domain name: contoso.local
Uppercase full domain name: CONTOSO.LOCAL
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
Logon ID [Type = HexInt64]: hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”
Audit Policy Change:
Category: the name of auditing Category which subcategory was changed. Possible values:
Account Logon
Account Management
Detailed Tracking
DS Access
Logon/Logoff
Object Access
Policy Change
Privilege Use
System
Subcategory: the name of auditing Subcategory which was changed. Possible values:
| Credential Validation | Process Termination | Network Policy Server |
|---|---|---|
| Kerberos Authentication Service | RPC Events | Other Logon/Logoff Events |
| Kerberos Service Ticket Operations | Detailed Directory Service Replication | Special Logon |
| Other Logon/Logoff Events | Directory Service Access | Application Generated |
| Application Group Management | Directory Service Changes | Certification Services |
| Computer Account Management | Directory Service Replication | Detailed File Share |
| Distribution Group Management | Account Lockout | File Share |
| Other Account Management Events | IPsec Extended Mode | File System |
| Security Group Management | IPsec Main Mode | Filtering Platform Connection |
| User Account Management | IPsec Quick Mode | Filtering Platform Packet Drop |
| DPAPI Activity | Logoff | Handle Manipulation |
| Process Creation | Logon | Kernel Object |
| Other Object Access Events | Filtering Platform Policy Change | IPsec Driver |
| Registry | MPSSVC Rule-Level Policy Change | Other System Events |
| SAM | Other Policy Change Events | Security State Change |
| Policy Change | Non-Sensitive Privilege Use | Security System Extension |
| Authentication Policy Change | Sensitive Privilege Use | System Integrity |
| Authorization Policy Change | Other Privilege Use Events | Plug and Play Events |
| Group Membership |
- Subcategory GUID: the unique subcategory GUID. To see Subcategory GUIDs you can use this command: auditpol /list /subcategory:* /v.
Note GUID is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.
Changes: changes which were made for “Subcategory”. Possible values:
Success removed
Failure removed
Success added
Failure added
It can be also a combination of any of the items above, separated by coma.
Security Monitoring Recommendations
For 4719(S): System audit policy was changed.
- Monitor for all events of this type, especially on high value assets or computers, because any change in local audit policy should be planned. If this action was not planned, investigate the reason for the change.