What exactly was changed in audit policy change log (Event ID 4719)

Question

Currently we receive event log of Event ID 4719 Success Audit: System audit policy was changed. We seem to not able to find what was changed and who changed it by just checking the Event ID 4719.

Please kindly share what can we do to find what were changed from this event.

Thanks!

Answer 1

Hello Loeun Sokoeun,

Thank you for posting in our Q&A forum.

Event ID 4719 will generate after I changed any audit policy successfully.

For example, in my lab, I tested as below.

1.After I enabled one audit policy as below.

2. Then I run gpupdate /for, I will see the 14 events related to 4719.
   
3. Because the Audit object access contains 14 sub policy entries (we can see the number of 14 sub policy entries via Advanced Audit Policy).
   

Note: you can try to change any audit policy setting in test lab and check the event ID 4719.

Hope the information above is helpful. If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi Loeun Sokoeun,

To see exactly what change was made in the security audit policy, you can take the "SubcategoryGuid" field of the log. from where you can get the exact subcategory where the change was made.

With the command "auditpol /list /subcategory:* /v" you can see the GUID for each subcategory.

And with the number in the "AuditPolicyChanges" field you can see if the success/failure of that subcategory was activated/deactivated.

options for "AuditPolicyChanges":

• %%8448 Success removed
• %%8449 Success Added
• %%8450 Failure removed
• %%8451 Failure added

Even though it has been almost a year I hope it will be helpful to you and others who need it.

Best Regards.