4694(S, F): Protection of auditable protected data was attempted.
This event generates if DPAPI CryptProtectData() function was used with CRYPTPROTECT_AUDIT flag (dwFlags) enabled.
There is no example of this event in this document.
Subcategory: Audit DPAPI Activity
Protection of auditable protected data was attempted.
Protected Data Flags:%7
Required Server Roles: None.
Minimum OS Version: Windows Server 2008, Windows Vista.
Event Versions: 0.
Security Monitoring Recommendations
There is no recommendation for this event in this document.
This event is typically an informational event and it is difficult to detect any malicious activity using this event. It’s mainly used for DPAPI troubleshooting.
Submit and view feedback for