Event ID 4907Audit SuccessSecurityT1562.002

Windows Event ID 4907 — Auditing Settings Changed on Object

Logged when the System Access Control List (SACL) on an object is modified, changing what activity is audited on that object.

MITRE ATT&CK

Technique

T1562.002 · Disable Windows Event Logging

Tactic

Defense Evasion

View on attack.mitre.org →

Why It Matters

Attackers modify SACLs to remove auditing from sensitive objects — LSASS, NTDS.dit, or privileged registry keys — so that their subsequent access does not generate Event ID 4663 or 4657 entries. This is a defense evasion technique that blinds defenders by disabling the very logging that would detect a credential dump. Any unexpected SACL change on a security-sensitive object should be investigated.

Key Fields

Object NameThe object whose audit settings changed — focus on lsass.exe, NTDS.dit, SAM hive, or sensitive registry keys
Object TypeFile, key, or other — indicates what class of object had its auditing changed
Subject Account NameWho changed the SACL — should be a known admin performing authorized configuration
New SdThe new Security Descriptor — a blank or reduced SACL means auditing was removed

Investigation Tips

  1. 1.A SACL change removing auditing from lsass.exe, ntds.dit, SAM, or NTLM-related registry keys is a strong indicator of pre-attack preparation for credential dumping.
  2. 2.Compare Old Sd vs New Sd — removal of audit ACEs (A;;...) indicates auditing was stripped. An empty SACL (no audit entries) means no further access events will be logged for that object.
  3. 3.Is this always malicious? No — SACLs are modified during legitimate system configuration, Group Policy updates, and software installation. Look for unexpected accounts, unusual timing, or sensitive target objects.
  4. 4.Correlate with Event ID 4663 gaps: if you had LSASS access auditing enabled and 4907 shows it was removed, check for a subsequent access window where 4663 would not have fired.
  5. 5.Check Event ID 4688 near the same time for processes running SeSecurityPrivilege (required to modify SACLs).

Go deeper: the full Credential Dumping guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the Credential Dumping guide →

See Event ID 4907 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →