Windows Event ID 4794 – Security: An Attempt Was Made to Set the Directory Services Restore Mode Administrator Password

Start by examining the complete event details to understand who initiated the DSRM password change and when it occurred.

1. Open Event Viewer on the affected domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4794 using the filter option
4. Double-click the event to view detailed information including:
   • Subject Security ID and Account Name
   • Target Account Name (DSRM administrator)
   • Process Information and Process Name
   • Network Information if applicable
5. Document the timestamp, source workstation, and user account for audit purposes

Use PowerShell to query multiple domain controllers simultaneously:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4794} -ComputerName DC01,DC02,DC03 | Select-Object TimeCreated,MachineName,Message | Format-Table -AutoSize

Confirm whether the DSRM password change was authorized and follows your organization's change management procedures.

1. Check your change management system for approved DSRM password rotation requests
2. Verify the user account has appropriate permissions for DSRM operations
3. Review Active Directory administrative group memberships:

Get-ADGroupMember "Domain Admins" | Select-Object Name,SamAccountName
Get-ADGroupMember "Enterprise Admins" | Select-Object Name,SamAccountName

4. Cross-reference the event timestamp with maintenance windows or scheduled tasks
5. Interview the user identified in the event to confirm legitimate activity
6. Check for corresponding events on other domain controllers in the same timeframe

Examine the process information and network context to determine how the DSRM password change was initiated.

1. Review the Process Name field in Event ID 4794 to identify the tool used (typically ntdsutil.exe)
2. Check for suspicious processes or unexpected applications performing DSRM operations
3. Analyze network information if the change originated from a remote system:

# Check for related logon events around the same time
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like "*username_from_4794*"}

4. Examine parent processes and command-line arguments if available through advanced auditing
5. Correlate with other security events like Event ID 4672 (Special privileges assigned to new logon)
6. Review firewall logs and network monitoring tools for suspicious connections to the domain controller

Enable advanced process auditing for future monitoring:

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

Deploy comprehensive monitoring to detect and alert on future DSRM password changes in real-time.

1. Configure Windows Event Forwarding to centralize Event ID 4794 collection:

<QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[EventID=4794]]</Select>
  </Query>
</QueryList>

2. Create PowerShell monitoring script for immediate alerting:

# DSRM Password Change Monitor
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4794" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    Send-MailMessage -To "security@company.com" -Subject "DSRM Password Change Detected" -Body "Event ID 4794 detected on $($Event.ComputerName) at $($Event.TimeGenerated)"
}

3. Configure SIEM integration to correlate DSRM events with other security indicators
4. Set up automated response workflows for unauthorized DSRM password changes
5. Implement Group Policy to enforce DSRM password complexity and rotation policies

Conduct thorough forensic analysis when Event ID 4794 indicates potential security incidents or policy violations.

1. Preserve evidence by creating forensic copies of relevant log files:

# Export Security logs for forensic analysis
wevtutil epl Security C:\Forensics\Security_$(Get-Date -Format 'yyyyMMdd_HHmmss').evtx
wevtutil epl System C:\Forensics\System_$(Get-Date -Format 'yyyyMMdd_HHmmss').evtx

2. Analyze registry changes related to DSRM configuration:

# Check DSRM-related registry keys
Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehavior" -ErrorAction SilentlyContinue

3. Review Active Directory replication logs for anomalies
4. Examine memory dumps if available for process analysis
5. Coordinate with incident response team to determine scope and impact
6. Document findings and implement remediation measures