Windows EventInformation
Windows Event ID 4897 – Microsoft-Windows-Security-Auditing: Certificate Services Template Security Descriptor Changed
Event ID 4897 fires when security permissions on a Certificate Authority template are modified, indicating changes to who can request, manage, or enroll certificates from that template.