Windows EventInformation
Windows Event ID 4896 – Microsoft-Windows-Security-Auditing: Certificate Services Template Security Descriptor Modified
Event ID 4896 fires when security permissions on a Certificate Authority template are modified, indicating changes to who can request, approve, or manage specific certificate types.
