Windows Event ID 4719 – Microsoft-Windows-Security-Auditing: System Audit Policy Changed

Start by examining the specific details of the Event ID 4719 to understand what changed and who initiated the modification.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4719 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4719 in the Event IDs field and click OK
5. Double-click on the most recent Event ID 4719 to view details
6. Review the General tab for basic information including timestamp and user account
7. Check the Details tab for comprehensive information about the audit policy changes
8. Note the Subject section showing who made the change and the Audit Policy Change section showing what was modified

Use PowerShell to programmatically analyze Event ID 4719 occurrences and extract detailed information about audit policy changes.

1. Open PowerShell as Administrator
2. Query recent Event ID 4719 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Get detailed information about specific events:

   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 5
   foreach ($event in $events) {
       $xml = [xml]$event.ToXml()
       Write-Host "Time: $($event.TimeCreated)"
       Write-Host "User: $($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text')"
       Write-Host "Category: $($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'CategoryId'} | Select-Object -ExpandProperty '#text')"
       Write-Host "---"
   }

4. Filter events by specific time range:

   $startTime = (Get-Date).AddDays(-7)
   $endTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719; StartTime=$startTime; EndTime=$endTime}

Verify the current audit policy settings to understand what logging is currently enabled and compare against your security requirements.

1. Open Command Prompt as Administrator
2. Display current audit policy settings:

   auditpol /get /category:*

3. Get detailed subcategory information:

   auditpol /get /subcategory:*

4. Check specific audit categories that are commonly targeted:

   auditpol /get /subcategory:"Logon" /subcategory:"Account Logon" /subcategory:"Object Access" /subcategory:"Policy Change"

5. Export current audit policy for backup:

   auditpol /backup /file:C:\temp\current_audit_policy.csv

6. Compare with Group Policy settings by opening Group Policy Management Console and navigating to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration

Analyze the context around Event ID 4719 to determine if the audit policy change was legitimate or potentially malicious.

1. Correlate with other security events around the same timeframe:

   $auditChangeTime = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 1).TimeCreated
   $startTime = $auditChangeTime.AddMinutes(-10)
   $endTime = $auditChangeTime.AddMinutes(10)
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.Id -in @(4624,4625,4648,4672)} | Format-Table TimeCreated, Id, Message -Wrap

2. Check for process creation events (Event ID 4688) around the same time:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.Message -like '*auditpol*' -or $_.Message -like '*secpol*'}

3. Review logon events for the user who made the change:

   $userSID = "S-1-5-21-..." # Extract from Event ID 4719 details
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object {$_.Message -like "*$userSID*"} | Select-Object -First 5

4. Check system event log for related service or application events:

   Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.Message -like '*policy*' -or $_.Message -like '*audit*'}

Set up proactive monitoring to detect and alert on Event ID 4719 occurrences for enhanced security posture.

1. Create a custom Windows Event Forwarding subscription for centralized monitoring:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>AuditPolicyChanges</SubscriptionId>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4719]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

2. Configure a scheduled task to run PowerShell monitoring script:

   $action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\Monitor-AuditPolicyChanges.ps1'
   $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15)
   $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount
   Register-ScheduledTask -TaskName 'Monitor-Event4719' -Action $action -Trigger $trigger -Principal $principal

3. Create monitoring script content:

   # Monitor-AuditPolicyChanges.ps1
   $lastCheck = (Get-Date).AddMinutes(-20)
   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719; StartTime=$lastCheck} -ErrorAction SilentlyContinue
   if ($events) {
       $events | ForEach-Object {
           $message = "ALERT: Audit policy changed at $($_.TimeCreated) by user in event details"
           Write-EventLog -LogName Application -Source "Custom Security Monitor" -EventId 9999 -Message $message -EntryType Warning
       }
   }

4. Set up Windows Performance Toolkit (WPT) for advanced analysis if needed
5. Configure SIEM integration to forward Event ID 4719 to your security operations center