Windows Event ID 4621 – LSA: Administrator Recovery Agent Policy Changed

Start by examining the complete event details to understand what recovery agent changes occurred.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4621 using the filter option
3. Double-click the most recent 4621 event to view details
4. Review the General tab for basic information
5. Click the Details tab and select XML View for complete data
6. Note the SubjectUserName field showing who made the change
7. Check the RecoveryAgentName and RecoveryAgentThumbprint fields

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4621} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message

Check the current EFS recovery agent policy to understand the active configuration.

1. Press Win + R, type secpol.msc, and press Enter
2. Navigate to Public Key Policies → Encrypting File System
3. Right-click Encrypting File System and select Properties
4. Review the General tab for current recovery agent certificates
5. Check certificate details by selecting each certificate and clicking View Certificate

Use PowerShell to enumerate recovery agents programmatically:

# Check EFS recovery policy
Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\EFS\Certificates" -ErrorAction SilentlyContinue

# Query recovery agent certificates from certificate store
Get-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object {$_.EnhancedKeyUsageList -match "File Recovery"}

Investigate whether Group Policy changes triggered the recovery agent modification.

1. Open Group Policy Management Console (gpmc.msc) on a domain controller
2. Navigate to the relevant GPO affecting the target computer
3. Edit the GPO and go to Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies
4. Check Encrypting File System settings for recent changes
5. Review GPO version history and modification dates

Use PowerShell to check Group Policy processing:

# Check last Group Policy refresh
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502} -MaxEvents 5

# Review EFS-related Group Policy events
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Group Policy EFS'} -MaxEvents 10 -ErrorAction SilentlyContinue

# Force Group Policy refresh to test
gpupdate /force

Check the Group Policy processing log:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-GroupPolicy/Operational'; Id=4016,4017} -MaxEvents 10

Examine certificate store modifications that might have triggered the recovery agent policy update.

1. Open Microsoft Management Console (mmc.exe)
2. Add the Certificates snap-in for Computer account
3. Navigate to Personal → Certificates
4. Look for certificates with File Recovery in the intended purposes
5. Check certificate validity dates and issuer information
6. Review the Trusted Root Certification Authorities store for changes

Use PowerShell to audit certificate changes:

# List all certificates with File Recovery capability
Get-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object {
    $_.EnhancedKeyUsageList.FriendlyName -contains "File Recovery"
} | Select-Object Subject, Issuer, NotAfter, Thumbprint

# Check certificate store audit events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876,4877,4878} -MaxEvents 20 -ErrorAction SilentlyContinue

Monitor certificate installation events:

# Certificate services events
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-CertificateServices-Deployment'} -MaxEvents 10 -ErrorAction SilentlyContinue

Perform deep analysis of recovery agent policy changes using registry inspection and advanced PowerShell techniques.

1. Open Registry Editor (regedit.exe) as administrator
2. Navigate to HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\EFS
3. Examine the Certificates subkey for recovery agent certificate data
4. Check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS for EFS configuration
5. Review HKLM\SYSTEM\CurrentControlSet\Control\Lsa for LSA audit settings

Use advanced PowerShell analysis:

# Export current EFS policy for analysis
$efsPolicy = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\EFS\*" -ErrorAction SilentlyContinue
$efsPolicy | Format-List

# Decode recovery agent certificates from registry
$certPath = "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\EFS\Certificates"
Get-ChildItem -Path $certPath -ErrorAction SilentlyContinue | ForEach-Object {
    $certData = Get-ItemProperty -Path $_.PSPath -Name "Blob" -ErrorAction SilentlyContinue
    if ($certData) {
        $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
        $cert.Import($certData.Blob)
        [PSCustomObject]@{
            Subject = $cert.Subject
            Issuer = $cert.Issuer
            Thumbprint = $cert.Thumbprint
            ValidFrom = $cert.NotBefore
            ValidTo = $cert.NotAfter
        }
    }
}

Create a comprehensive audit report:

# Generate EFS recovery agent audit report
$report = @()
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4621} -MaxEvents 50 -ErrorAction SilentlyContinue
foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $report += [PSCustomObject]@{
        TimeCreated = $event.TimeCreated
        User = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
        Domain = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'} | Select-Object -ExpandProperty '#text'
        RecoveryAgent = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'RecoveryAgentName'} | Select-Object -ExpandProperty '#text'
    }
}
$report | Export-Csv -Path "C:\temp\EFS_Recovery_Agent_Changes.csv" -NoTypeInformation