Windows Event ID 4716 – Security: A Trusted Domain Information Was Modified

Start by examining the specific details of the Event ID 4716 entry to understand what was modified.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4716 using the filter option
4. Double-click the event to view detailed information
5. Review the following key fields:
   • Subject: Account that made the change
   • Trusted Domain Information: Details about the modified trust
   • Changes Made: Specific modifications performed
6. Note the timestamp and correlate with any scheduled maintenance or administrative activities

Use PowerShell to query and analyze Event ID 4716 entries across multiple domain controllers.

1. Open PowerShell as Administrator
2. Query recent trust modification events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4716} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4716; StartTime=$StartTime}
   $Events | Format-Table TimeCreated, Message -Wrap

4. Extract specific trust information:

   $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $EventData = $Event.Event.EventData.Data
       [PSCustomObject]@{
           Time = $_.TimeCreated
           User = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           Domain = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           TrustedDomain = ($EventData | Where-Object {$_.Name -eq 'TrustedDomainName'}).'#text'
       }
   }

Validate the current trust configuration to ensure modifications were applied correctly and identify any issues.

1. Check trust relationships using netdom:

   netdom trust /domain:yourdomain.com /verify

2. List all trust relationships:

   Get-ADTrust -Filter * | Select-Object Name, Direction, TrustType, Created, Modified

3. Test trust connectivity:

   Test-ComputerSecureChannel -Server dc01.yourdomain.com

4. Verify trust authentication:

   nltest /trusted_domains

5. Check trust validation settings:

   Get-ADTrust -Identity "TrustedDomainName" | Select-Object SelectiveAuthentication, SIDFilteringQuarantined

6. Review trust properties in Active Directory Domains and Trusts console

Perform comprehensive auditing of trust modifications to identify patterns or unauthorized changes.

1. Enable advanced audit policies if not already configured:

   auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable

2. Query trust modification events across all domain controllers:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Invoke-Command -ComputerName $DC.Name -ScriptBlock {
           Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4716} -MaxEvents 20 -ErrorAction SilentlyContinue
       }
   }

3. Create a comprehensive trust audit report:

   $TrustEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4716} -MaxEvents 100
   $Report = $TrustEvents | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           User = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           Domain = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           TrustedDomain = ($EventData | Where-Object {$_.Name -eq 'TrustedDomainName'}).'#text'
           Changes = $_.Message
       }
   }
   $Report | Export-Csv -Path "C:\TrustAudit.csv" -NoTypeInformation

Set up proactive monitoring for trust modifications to detect unauthorized changes quickly.

1. Create a scheduled task to monitor Event ID 4716:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\TrustMonitor.ps1"
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15)
   $Principal = New-ScheduledTaskPrincipal -UserID "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "TrustModificationMonitor" -Action $Action -Trigger $Trigger -Principal $Principal

2. Create the monitoring script (C:\Scripts\TrustMonitor.ps1):

   # Check for new Event ID 4716 entries
   $LastCheck = Get-Content "C:\Scripts\LastCheck.txt" -ErrorAction SilentlyContinue
   if (-not $LastCheck) { $LastCheck = (Get-Date).AddHours(-1) }
   
   $NewEvents = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4716
       StartTime=[DateTime]$LastCheck
   } -ErrorAction SilentlyContinue
   
   if ($NewEvents) {
       # Send alert email or notification
       $Body = "Trust modification detected: $($NewEvents.Count) events"
       Send-MailMessage -To "admin@company.com" -From "monitor@company.com" -Subject "Trust Modification Alert" -Body $Body -SmtpServer "mail.company.com"
   }
   
   Get-Date | Out-File "C:\Scripts\LastCheck.txt"

3. Configure Windows Event Forwarding to centralize trust modification events
4. Set up SIEM integration to correlate trust changes with other security events