Windows Event ID 4715 – Microsoft-Windows-Security-Auditing: System Security Access Control Policy Changed

Start by examining the specific details of Event ID 4715 to understand what policy changes occurred.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4715 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4715 in the Event IDs field and click OK
5. Double-click on recent 4715 events to view detailed information
6. Review the event data including Policy Category, Subcategory Changes, and Process Information

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4715} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Cross-reference Event ID 4715 with Group Policy processing events to understand the source of policy changes.

1. Open Event Viewer and navigate to Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational
2. Look for events around the same time as the 4715 events, particularly Event IDs 1502 (Group Policy processing started) and 1503 (Group Policy processing completed)
3. Check the System log for Event ID 1129 (Group Policy processing completed successfully)
4. Use PowerShell to correlate events by timestamp:

# Get 4715 events from the last 24 hours
$securityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4715; StartTime=(Get-Date).AddDays(-1)}

# Get Group Policy events from the same timeframe
$gpEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-GroupPolicy/Operational'; StartTime=(Get-Date).AddDays(-1)}

# Display correlated events
$securityEvents | ForEach-Object {
    $eventTime = $_.TimeCreated
    Write-Host "Security Policy Change: $eventTime"
    $gpEvents | Where-Object {$_.TimeCreated -gt $eventTime.AddMinutes(-5) -and $_.TimeCreated -lt $eventTime.AddMinutes(5)} | Select-Object TimeCreated, Id, LevelDisplayName
}

Compare current security policy settings with previous configurations to identify specific changes.

1. Export current security policy configuration using secedit:

# Export current security database to a readable format
secedit /export /cfg C:\temp\current_security_policy.inf /areas SECURITYPOLICY

# Generate a security analysis report
secedit /analyze /cfg C:\temp\current_security_policy.inf /db C:\temp\security_analysis.sdb /log C:\temp\analysis.log

2. Review the exported policy file to understand current settings:

# View specific sections of the security policy
Get-Content C:\temp\current_security_policy.inf | Select-String -Pattern "Audit|Rights|Privilege"

3. Check Group Policy Resultant Set of Policy (RSoP) for detailed policy information:

# Generate RSoP report for current user and computer
gpresult /h C:\temp\gpresult.html /f

# View specific security settings
gpresult /z | Select-String -Pattern "Security Settings|Audit Policy"

4. Use PowerShell to query specific audit policy settings:

# Get current audit policy configuration
auditpol /get /category:*

# Get detailed subcategory information
auditpol /get /subcategory:* /r

Configure enhanced monitoring to track future policy changes and their sources more effectively.

1. Enable advanced audit policy subcategories for better tracking:

# Enable audit policy change tracking
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable

# Enable security system extension auditing
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

# Enable system integrity auditing
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

2. Configure Group Policy to log detailed policy processing information:
3. Navigate to Computer Configuration → Administrative Templates → System → Group Policy
4. Enable Configure Group Policy processing to use synchronous foreground policy refresh
5. Enable Turn on Group Policy logging
6. Set up PowerShell monitoring script for real-time tracking:

# Create a monitoring script for policy changes
$action = {
    $event = $Event.SourceEventArgs.NewEvent
    $message = "Policy Change Detected: {0} at {1}" -f $event.Id, $event.TimeCreated
    Write-Host $message -ForegroundColor Yellow
    
    # Log to custom file
    $logEntry = "{0}: Event {1} - {2}" -f $event.TimeCreated, $event.Id, $event.Message
    Add-Content -Path "C:\temp\policy_changes.log" -Value $logEntry
}

# Register event watcher
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4715" -Action $action

Perform forensic analysis when Event ID 4715 indicates potential unauthorized security policy modifications.

1. Identify the source process and user context for policy changes:

# Query detailed event information including process details
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4715} -MaxEvents 20 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $processId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
    $processName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    $subjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
    
    Write-Host "Time: $($_.TimeCreated) | Process: $processName ($processId) | User: $subjectUserName"
}

2. Check for related logon events to identify the source of changes:

# Look for logon events around the time of policy changes
$policyChangeTime = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4715} -MaxEvents 1).TimeCreated
$startTime = $policyChangeTime.AddMinutes(-30)
$endTime = $policyChangeTime.AddMinutes(30)

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$startTime; EndTime=$endTime} | Format-Table TimeCreated, Id, Message -Wrap

3. Analyze registry changes related to security policies:

# Check security policy registry locations
$securityKeys = @(
    'HKLM\SYSTEM\CurrentControlSet\Control\Lsa',
    'HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security',
    'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
)

foreach ($key in $securityKeys) {
    Write-Host "Checking registry key: $key"
    try {
        Get-ItemProperty -Path "Registry::$key" -ErrorAction Stop | Format-List
    } catch {
        Write-Host "Unable to access $key" -ForegroundColor Red
    }
}

4. Review file system changes to policy-related files:

# Check timestamps on Group Policy files
$gpPaths = @(
    "$env:WINDIR\System32\GroupPolicy",
    "$env:WINDIR\System32\GroupPolicyUsers"
)

foreach ($path in $gpPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -File | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} | Format-Table Name, LastWriteTime, Length
    }
}