4694(S, F): Protection of auditable protected data was attempted.

This event generates if DPAPI  CryptProtectData() function was used with CRYPTPROTECT_AUDIT flag (dwFlags) enabled.

There is no example of this event in this document.

Subcategory: Audit DPAPI Activity

Event Schema:

Protection of auditable protected data was attempted.

Subject:

Security ID:%1

Account Name:%2

Account Domain:%3

Logon ID:%4

Protected Data:

Data Description:%6

Key Identifier:%5

Protected Data Flags:%7

Protection Algorithms:%8

Status Information:

Status Code:%9

Required Server Roles: None.

Minimum OS Version: Windows Server 2008, Windows Vista.

Event Versions: 0.

Security Monitoring Recommendations

• There is no recommendation for this event in this document.

• This event is typically an informational event and it is difficult to detect any malicious activity using this event. It’s mainly used for DPAPI troubleshooting.