Windows EventInformation
Windows Event ID 4872 – Microsoft-Windows-Security-Auditing: Certificate Services Template Security Permissions Changed
Event ID 4872 fires when security permissions on a Certificate Authority template are modified. This audit event tracks changes to certificate template access control lists and helps monitor PKI security modifications.