Windows Event ID 4936 – Microsoft-Windows-Security-Auditing: User Account Management Policy Change

Start by examining the specific details of Event ID 4936 to understand what policy was changed and by whom.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4936 using the filter option
4. Double-click the event to view detailed information including:
• Subject: The user account that made the change
• Policy Change: Specific policy object that was modified
• Process Information: The process that initiated the change
5. Note the timestamp and correlate with any recent administrative activities

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4936} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Use PowerShell to extract detailed information about the policy changes and identify patterns or unauthorized modifications.

1. Query Event ID 4936 events with detailed filtering:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4936; StartTime=(Get-Date).AddDays(-7)}
foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    $Subject = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
    $PolicyName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'PolicyName'} | Select-Object -ExpandProperty '#text'
    Write-Output "Time: $($Event.TimeCreated) | User: $Subject | Policy: $PolicyName"
}

2. Cross-reference the changes with current domain policy settings:

Get-ADDefaultDomainPasswordPolicy | Format-List *

3. Check for any recent Group Policy modifications that might correlate with the events

Examine Group Policy Management Console logs and settings to understand the context of policy changes.

1. Open Group Policy Management Console (gpmc.msc)
2. Navigate to Forest → Domains → Your Domain → Default Domain Policy
3. Right-click Default Domain Policy and select Edit
4. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies
5. Review current settings for:
• Password Policy
• Account Lockout Policy
• Kerberos Policy
6. Check the Security tab of the Default Domain Policy to see who has permissions to modify it
7. Use PowerShell to get detailed policy information:

Get-GPO -Name "Default Domain Policy" | Get-GPPermission -All | Where-Object {$_.Permission -eq "GpoEdit"}

Configure comprehensive auditing to capture more detailed information about future policy changes.

1. Open Group Policy Management Console and edit the Default Domain Controllers Policy
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Policy Change
3. Enable Audit Authentication Policy Change for both Success and Failure
4. Enable Audit Authorization Policy Change for both Success and Failure
5. Apply the policy and run gpupdate on domain controllers:

gpupdate /force

6. Verify the audit settings are applied:

auditpol /get /subcategory:"Authentication Policy Change"

7. Set up automated monitoring using PowerShell:

Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4936" -Action {
    $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
    Write-Host "Policy Change Detected: $($Event.TimeGenerated) - $($Event.Message)"
}

Deploy enterprise-level monitoring and alerting for critical policy changes using advanced PowerShell scripting and Windows Event Forwarding.

1. Create a comprehensive monitoring script that tracks all policy-related events:

# Save as Monitor-PolicyChanges.ps1
param(
    [string]$LogPath = "C:\Logs\PolicyChanges.log",
    [string]$SMTPServer = "mail.company.com",
    [string]$AlertEmail = "security@company.com"
)

$EventFilter = @{
    LogName = 'Security'
    Id = 4936, 4739, 4713, 4719
    StartTime = (Get-Date).AddMinutes(-5)
}

$Events = Get-WinEvent -FilterHashtable $EventFilter -ErrorAction SilentlyContinue

foreach ($Event in $Events) {
    $EventData = [xml]$Event.ToXml()
    $LogEntry = "$(Get-Date): Event $($Event.Id) - User: $($EventData.Event.EventData.Data[1].'#text') - Policy: $($EventData.Event.EventData.Data[4].'#text')"
    Add-Content -Path $LogPath -Value $LogEntry
    
    # Send alert for critical changes
    if ($Event.Id -eq 4936) {
        Send-MailMessage -To $AlertEmail -From "noreply@company.com" -Subject "Critical Policy Change Detected" -Body $LogEntry -SmtpServer $SMTPServer
    }
}

2. Schedule the script to run every 5 minutes using Task Scheduler:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-PolicyChanges.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName "PolicyChangeMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Configure Windows Event Forwarding to centralize policy change events from all domain controllers
4. Set up custom Event Viewer views to filter and display policy change events across the domain