Windows Event ID 4908 – Security: Trusted Domain Information Changed

Start by examining the specific details of Event ID 4908 to understand what trust change occurred.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4908 using the filter option
4. Double-click the event to view detailed information
5. Review the event data including:
   • Trusted Domain Name
   • Trust Type and Direction
   • Subject (who made the change)
   • Process Information

Use PowerShell to query recent 4908 events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4908} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

For detailed event parsing:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4908} -MaxEvents 5 | ForEach-Object { [xml]$xml = $_.ToXml(); $xml.Event.EventData.Data }

Confirm the current state of domain trusts to validate the changes recorded in Event ID 4908.

1. Open Active Directory Domains and Trusts console
2. Right-click your domain and select Properties
3. Click the Trusts tab to view current trust relationships
4. Verify trust direction, type, and status

Use PowerShell to enumerate all domain trusts:

Get-ADTrust -Filter * | Select-Object Name, Direction, TrustType, Created, Modified | Format-Table -AutoSize

For detailed trust information:

Get-ADTrust -Filter * | ForEach-Object { Get-ADTrust -Identity $_.Name | Select-Object Name, Direction, TrustType, TrustAttributes, Created, Modified }

Test trust connectivity:

Test-ComputerSecureChannel -Verbose

Examine related authentication events to understand the impact of trust changes on user authentication.

1. In Event Viewer, navigate to Windows Logs → Security
2. Filter for authentication-related events:
   • Event ID 4624 (successful logon)
   • Event ID 4625 (failed logon)
   • Event ID 4768 (Kerberos TGT requested)
   • Event ID 4769 (Kerberos service ticket requested)
3. Look for events involving the trusted domain users

Query cross-domain authentication events:

$StartTime = (Get-Date).AddHours(-24)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4768,4769; StartTime=$StartTime}
$Events | Where-Object {$_.Message -like '*trusted*domain*'} | Format-Table TimeCreated, Id, Message -Wrap

Check for trust-related failures:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=5805,5723} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Examine trust security configurations to ensure proper authentication and authorization settings.

1. Open Active Directory Domains and Trusts
2. Right-click the domain and select Properties
3. Go to the Trusts tab
4. Select a trust and click Properties
5. Review authentication settings and SID filtering options

Check trust authentication policies using PowerShell:

Get-ADTrust -Filter * | ForEach-Object {
    $Trust = $_
    Write-Host "Trust: $($Trust.Name)" -ForegroundColor Green
    Write-Host "Direction: $($Trust.Direction)"
    Write-Host "Type: $($Trust.TrustType)"
    Write-Host "SID Filtering: $($Trust.SIDFilteringEnabled)"
    Write-Host "Selective Auth: $($Trust.SelectiveAuthentication)"
    Write-Host "---"
}

Verify trust validation status:

Get-ADTrust -Filter * | ForEach-Object {
    $TrustName = $_.Name
    try {
        Test-ADTrust -Identity $TrustName -Verbose
        Write-Host "Trust $TrustName validation: SUCCESS" -ForegroundColor Green
    } catch {
        Write-Host "Trust $TrustName validation: FAILED - $($_.Exception.Message)" -ForegroundColor Red
    }
}

Implement comprehensive monitoring for future trust modifications to maintain security oversight.

1. Open Group Policy Management Console
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management
4. Configure Audit User Account Management for Success and Failure
5. Apply the policy to domain controllers

Enable detailed trust auditing via registry:

$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $RegPath -Name "AuditBaseObjects" -Value 1 -Type DWord
Restart-Service -Name "NTDS" -Force

Create a PowerShell monitoring script:

$ScriptBlock = {
    $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4908} -MaxEvents 1
    if ($Events) {
        $Event = $Events[0]
        $Message = "Trust change detected at $($Event.TimeCreated): $($Event.Message)"
        Write-EventLog -LogName Application -Source "TrustMonitor" -EventId 1001 -Message $Message
        # Add email notification or SIEM integration here
    }
}
Register-ScheduledTask -TaskName "MonitorTrustChanges" -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)) -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command & {$ScriptBlock}")