Windows Event ID 4713 – Microsoft-Windows-Security-Auditing: Kerberos Policy Changed

Start by examining the complete event details to understand what Kerberos policy changed and who initiated the modification.

1. Open Event Viewer on the affected domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4713 using the filter option
4. Double-click the event to view detailed information
5. Review the General tab for policy change details including:
• Subject security identifier and account name
• Changed policy attributes and their new values
• Process name and ID responsible for the change
• Source computer name
6. Check the Details tab for XML view with complete event data
7. Note the timestamp to correlate with other administrative activities

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4713} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Use PowerShell to extract and analyze specific Kerberos policy modifications from Event ID 4713 entries.

1. Query events with detailed filtering:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4713; StartTime=(Get-Date).AddDays(-7)}
foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    $EventData = $EventXML.Event.EventData.Data
    Write-Host "Time: $($Event.TimeCreated)"
    Write-Host "Subject: $($EventData | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text')"
    Write-Host "Policy Changed: $($EventData | Where-Object {$_.Name -eq 'PolicyChanged'} | Select-Object -ExpandProperty '#text')"
    Write-Host "New Value: $($EventData | Where-Object {$_.Name -eq 'NewValue'} | Select-Object -ExpandProperty '#text')"
    Write-Host "---"
}

2. Export events to CSV for analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4713} | Select-Object TimeCreated, Id, LevelDisplayName, UserId, ProcessId, MachineName | Export-Csv -Path "C:\Temp\Kerberos_Policy_Changes.csv" -NoTypeInformation

3. Check current Kerberos policy settings:

Get-ADDomain | Select-Object MaxPwdAge, MinPwdAge, LockoutDuration, LockoutObservationWindow

Investigate Group Policy objects to identify the source of Kerberos policy changes and verify current settings.

1. Open Group Policy Management Console (gpmc.msc)
2. Navigate to the domain and expand Group Policy Objects
3. Right-click the Default Domain Policy and select Edit
4. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Kerberos Policy
5. Review current settings for:
• Maximum lifetime for user tickets
• Maximum lifetime for service tickets
• Maximum tolerance for computer clock synchronization
• Maximum lifetime for user ticket renewal
6. Check the Security tab to see who has permissions to modify the policy
7. Use PowerShell to query Group Policy settings:

Get-GPO -All | Where-Object {$_.DisplayName -like "*Default Domain Policy*"} | Get-GPOReport -ReportType HTML -Path "C:\Temp\DomainPolicy.html"

7. Generate Group Policy Results to see effective settings:

gpresult /h "C:\Temp\GPResult.html" /f

Cross-reference Event ID 4713 with other security events to build a complete picture of administrative activities.

1. Search for related logon events around the same timeframe:

$StartTime = (Get-Date).AddHours(-2)
$EndTime = (Get-Date)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Message -like "*administrator*" -or $_.Message -like "*domain admin*"}

2. Check for Group Policy modification events (Event ID 5136):

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136; StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.Message -like "*Kerberos*" -or $_.Message -like "*policy*"}

3. Review process creation events (Event ID 4688) for administrative tools:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-4)} | Where-Object {$_.Message -like "*gpmc.msc*" -or $_.Message -like "*powershell*" -or $_.Message -like "*dsa.msc*"}

4. Check Windows PowerShell operational log for cmdlet usage:

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 100 | Where-Object {$_.Message -like "*Set-AD*" -or $_.Message -like "*Kerberos*"}

5. Generate a timeline report combining multiple event sources:

$Timeline = @()
$Timeline += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4713,4624,4648,5136; StartTime=(Get-Date).AddDays(-1)}
$Timeline | Sort-Object TimeCreated | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Set up comprehensive monitoring for Kerberos policy changes to detect unauthorized modifications in real-time.

1. Create a scheduled task to monitor for Event ID 4713:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4713; StartTime=(Get-Date).AddMinutes(-5)} | ForEach-Object {Send-MailMessage -To 'admin@company.com' -From 'dc@company.com' -Subject 'Kerberos Policy Changed' -Body $_.Message -SmtpServer 'mail.company.com'}"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365)
Register-ScheduledTask -TaskName "Monitor-KerberosPolicy" -Action $Action -Trigger $Trigger -RunLevel Highest

2. Configure Windows Event Forwarding for centralized monitoring:

# On collector server
wecutil cs subscription.xml

# Create subscription.xml with Event ID 4713 filter
@"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>KerberosPolicyMonitoring</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*[System[EventID=4713]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>
"@ | Out-File subscription.xml

3. Set up custom Event Viewer views for Kerberos policy monitoring:

# Create custom view XML
$CustomView = @"
<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <Simple>
        <Channel>Security</Channel>
        <EventId>4713</EventId>
        <RelativeTimeInfo>604800000</RelativeTimeInfo>
      </Simple>
    </QueryParams>
  </QueryConfig>
</ViewerConfig>
"@
$CustomView | Out-File "C:\Windows\System32\winevt\Logs\KerberosPolicyView.xml"

4. Configure audit policy to ensure Event ID 4713 generation:

auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
auditpol /get /subcategory:"Authentication Policy Change"