Windows Event ID 4707 – Microsoft-Windows-Security-Auditing: Cryptographic Trust Removed

Start by reviewing the complete event details to understand what trust was removed and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4707 using the Filter Current Log option
4. Double-click the event to view detailed information including:
   • Subject: User account that performed the action
   • Certificate Information: Thumbprint, issuer, and subject details
   • Process Information: Application that initiated the removal
5. Note the timestamp and correlate with any recent system changes or maintenance activities

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4707} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Check the current state of certificate stores to understand what trusts remain and identify any missing certificates.

1. Open Certificate Manager by running certlm.msc as administrator
2. Expand Trusted Root Certification Authorities → Certificates
3. Review the list of trusted root CAs and compare against your organization's approved certificate list
4. Check Intermediate Certification Authorities for any missing intermediate certificates
5. Use PowerShell to enumerate certificate stores programmatically:

# List all certificates in Trusted Root store
Get-ChildItem -Path Cert:\LocalMachine\Root | Select-Object Subject, Issuer, Thumbprint, NotAfter | Format-Table -AutoSize

# Check for specific certificate by thumbprint from Event 4707
$thumbprint = "PASTE_THUMBPRINT_FROM_EVENT_HERE"
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq $thumbprint}

Document any missing certificates that may need to be reinstalled for proper system operation.

Investigate whether Group Policy changes or security policies triggered the certificate removal.

1. Open Group Policy Management Console (gpmc.msc) if in a domain environment
2. Review recent changes to policies affecting certificate management:
   • Computer Configuration → Windows Settings → Security Settings → Public Key Policies
   • Certificate path validation settings
   • Trusted root certification authorities policies
3. Check local security policy settings using secpol.msc
4. Use PowerShell to review Group Policy results:

# Generate Group Policy report
Get-GPResultantSetOfPolicy -ReportType Html -Path "C:\Temp\GPReport.html"

# Check certificate-related registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates" -ErrorAction SilentlyContinue

Determine which process or user initiated the certificate removal to identify the root cause.

1. From the Event 4707 details, note the Process Name and Process ID
2. Cross-reference with other security events around the same timeframe:

# Find related events by Process ID
$processId = "1234"  # Replace with actual PID from event
$startTime = (Get-Date).AddHours(-2)
$endTime = Get-Date

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    StartTime=$startTime
    EndTime=$endTime
} | Where-Object {$_.Message -like "*$processId*"} | Select-Object TimeCreated, Id, Message

3. Check if the process was legitimate system maintenance or potentially malicious activity
4. Review user account details and verify if the action was authorized
5. Examine process execution context using Process Monitor if the issue is ongoing
6. Check Windows Defender or other security software logs for related certificate actions

Restore necessary certificates and implement monitoring to prevent future issues.

1. If legitimate certificates were incorrectly removed, restore them from backup or download from the issuing CA
2. For domain environments, use Group Policy to deploy trusted certificates:

# Import certificate to Trusted Root store
$certPath = "C:\Temp\TrustedCA.cer"
Import-Certificate -FilePath $certPath -CertStoreLocation Cert:\LocalMachine\Root

# Verify certificate installation
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Subject -like "*YourCA*"}

3. Configure advanced audit policy to monitor certificate changes:

# Enable auditing for certificate operations
auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

# Verify audit policy settings
auditpol /get /subcategory:"Other Object Access Events"

4. Set up automated monitoring using PowerShell scripts or SIEM integration
5. Create alerts for Event ID 4707 occurrences to detect future unauthorized changes
6. Document the incident and update change management procedures to prevent recurrence

Consider implementing certificate pinning or additional validation mechanisms for critical applications to reduce dependency on system trust stores.