Windows Event ID 4612 – LSA: Security Audit Policy Changes

Start by examining the specific audit policy changes recorded in Event ID 4612:

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4612 using the filter option
3. Double-click the most recent 4612 event to view details
4. In the General tab, review the event description and timestamp
5. Switch to the Details tab and examine the XML data
6. Look for the AuditPolicyChanges field showing which categories were modified
7. Note the SubjectUserName and SubjectDomainName to identify who made the changes
8. Check the ProcessName field to see which tool was used (auditpol.exe, Group Policy, etc.)

Use PowerShell to query multiple 4612 events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4612} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Compare the current audit policy with expected settings to identify unauthorized changes:

1. Open Command Prompt as Administrator
2. Run the following command to display current audit policy:

auditpol /get /category:*

3. Review each audit category and its current setting (Success, Failure, Success and Failure, or No Auditing)
4. Compare against your organization's security baseline or compliance requirements
5. For detailed subcategory information, use:

auditpol /get /subcategory:*

6. Export current settings for documentation:

auditpol /backup /file:C:\temp\current_audit_policy.csv

7. Use PowerShell to get audit policy in a more readable format:

Get-AuditPolicy | Format-Table Category, Subcategory, AuditFlag -AutoSize

Check if Group Policy changes caused the audit policy modifications:

1. Open Group Policy Management Console (gpmc.msc)
2. Navigate to the relevant GPO affecting the target system
3. Edit the GPO and go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Review each audit policy category for recent changes
5. Check the Security Options section for audit-related settings
6. Use PowerShell to analyze Group Policy results:

Get-GPResultantSetOfPolicy -ReportType Html -Path C:\temp\gpresult.html

7. Review the generated report for audit policy settings
8. Check Group Policy event logs for policy application:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 10

9. Verify when Group Policy was last applied:

gpresult /r /scope:computer

Examine registry locations where audit policy settings are stored:

1. Open Registry Editor (regedit.exe) as Administrator
2. Navigate to the primary audit policy location:

HKLM\SECURITY\Policy\PolAdtEv

3. Check the Group Policy audit policy location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit

4. Use PowerShell to monitor registry changes in real-time:

$action = { Write-Host "Registry change detected: $($Event.SourceEventArgs.FullPath)" }
Register-WmiEvent -Query "SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit'" -Action $action

5. Check for recent registry modifications using Process Monitor (ProcMon):
6. Set filters for Registry activity on audit-related keys
7. Look for processes modifying audit policy registry values

Set up comprehensive monitoring for future audit policy changes:

1. Create a PowerShell script to monitor Event ID 4612:

# Save as Monitor-AuditPolicyChanges.ps1
$query = @"

  
    *[System[EventID=4612]]
  

"@

Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 4612" -Action {
    $event = $Event.SourceEventArgs.NewEvent.TargetInstance
    Write-Host "Audit Policy Change Detected at $($event.TimeGenerated)"
    Write-Host "User: $($event.User)"
    Write-Host "Message: $($event.Message)"
    # Add email notification or SIEM integration here
}

2. Configure Windows Event Forwarding for centralized monitoring:
3. On the collector server, create a custom view for Event ID 4612
4. Set up SIEM integration to alert on audit policy changes
5. Create a baseline audit policy configuration:

auditpol /backup /file:C:\baseline\baseline_audit_policy.csv

6. Schedule regular compliance checks:

# Compare current policy with baseline
$baseline = Import-Csv C:\baseline\baseline_audit_policy.csv
$current = auditpol /get /subcategory:* /r /format:csv | ConvertFrom-Csv

$differences = Compare-Object $baseline $current -Property 'Subcategory Name','Inclusion Setting'
if ($differences) {
    Write-Warning "Audit policy drift detected!"
    $differences | Format-Table
}