Windows Event ID 4719 — System Audit Policy Changed
Logged when the system's audit policy is modified — which controls what events get recorded in the Security log.
MITRE ATT&CK
Technique
T1562.002 · Disable Windows Event Logging
Tactic
Defense Evasion
Why It Matters
Attackers reduce audit policy coverage to blind defenders before carrying out their main actions. Disabling auditing for logon events or process creation before an attack leaves no trail.
Key Fields
Subject Account NameWho changed the policy
CategoryWhich audit category was changed (e.g. Logon/Logoff, Process Tracking)
SubcategoryThe specific subcategory changed
ChangesSuccess/Failure auditing enabled or disabled
Investigation Tips
- 1.Any reduction in audit policy coverage (Success/Failure removed) outside of authorized changes is suspicious.
- 2.Check if this was done via Group Policy (expected) or directly via auditpol.exe (potentially suspicious).
Go deeper: the full Credential Dumping guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Credential Dumping guide →See Event ID 4719 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →