Windows Event ID 4933 – Microsoft-Windows-Security-Auditing: Per-user audit policy table creation

Start by examining the event details to understand the context and timing of the audit policy table creation.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4933 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4933 in the Event IDs field and click OK
5. Double-click the most recent Event ID 4933 to view detailed information
6. Note the timestamp, user context, and any additional details in the event description

Use PowerShell to query multiple instances:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4933} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Examine the current per-user audit policy settings to understand what triggered the table creation.

1. Open an elevated Command Prompt or PowerShell session
2. Run the following command to display current audit policy settings:

auditpol /get /category:*

3. To check per-user audit policies specifically:

auditpol /get /user:* /category:*

4. Review Group Policy settings by opening gpedit.msc (Local Group Policy Editor)
5. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
6. Check if any per-user audit policies are configured under Audit Policies
7. Verify the Audit Policy Change subcategory is enabled to track future policy modifications

Investigate whether Group Policy changes triggered the audit policy table creation.

1. Check Group Policy application status:

gpresult /r /scope:computer

2. Generate a detailed Group Policy report:

gpresult /h C:\temp\gpreport.html /scope:computer

3. Open the generated HTML report and search for audit policy settings
4. Check the Group Policy event log for policy application events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-GroupPolicy'} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-24)}

5. Force a Group Policy refresh to test if the event recurs:

gpupdate /force

6. Monitor the Security log for new Event ID 4933 entries after the policy refresh
7. If in a domain environment, check domain controller event logs for policy replication issues

Examine the Local Security Authority Subsystem Service and related components that manage audit policies.

1. Check LSASS service status and recent restart events:

Get-Service -Name LSASS | Format-List *

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036} | Where-Object {$_.Message -like '*LSASS*'} | Select-Object TimeCreated, Id, Message

3. Review security subsystem initialization events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4608,4609} -MaxEvents 10

4. Check for security policy database corruption or rebuild events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'} | Where-Object {$_.Message -like '*security*'}

5. Examine the security policy registry location for recent modifications:

Get-ItemProperty -Path "HKLM\SECURITY\Policy" -ErrorAction SilentlyContinue

Enable detailed tracing for audit policy operations to capture comprehensive diagnostic information.

1. Enable audit policy debug logging by modifying the registry:

New-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -Name "AuditBaseObjects" -Value 1 -PropertyType DWORD -Force

2. Enable LSA audit and authentication logging:

auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable

auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable

3. Use Windows Performance Toolkit (WPT) to trace security subsystem activity:

# Start ETW trace for LSA operations
wpr -start GeneralProfile -filemode

4. Reproduce the issue by restarting the system or forcing a policy refresh
5. Stop the trace and analyze:

wpr -stop C:\temp\lsa_trace.etl

6. Use Event Tracing for Windows (ETW) to monitor real-time audit policy events:

# PowerShell script to monitor audit policy ETW events
$session = New-EtwTraceSession -Name "AuditPolicyTrace" -LogFileMode 0x8000100
Add-EtwTraceProvider -SessionName "AuditPolicyTrace" -Guid "{54849625-5478-4994-A5BA-3E3B0328C30D}" -Level 5
Start-EtwTraceSession -Name "AuditPolicyTrace"