Windows Event ID 4964 – Microsoft-Windows-Security-Auditing: Object Access Audit Policy Changed

Start by examining the specific details of the Event ID 4964 occurrence to understand what changed.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4964 using the Filter Current Log option
4. Double-click the most recent Event ID 4964 entry to view details
5. Review the General tab for policy change information including:
   • Subject Security ID (who made the change)
   • Previous Policy State
   • New Policy State
   • Process Information
6. Check the Details tab for XML view with complete event data

Use PowerShell to retrieve and analyze Event ID 4964 occurrences with filtering and formatting capabilities.

1. Open PowerShell as Administrator
2. Query recent Event ID 4964 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4964} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Get detailed information for specific events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4964} -MaxEvents 10
   foreach ($Event in $Events) {
       $EventXML = [xml]$Event.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       Write-Host "Time: $($Event.TimeCreated)"
       Write-Host "Subject: $($EventData | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text')"
       Write-Host "Previous Policy: $($EventData | Where-Object {$_.Name -eq 'PreviousPolicy'} | Select-Object -ExpandProperty '#text')"
       Write-Host "New Policy: $($EventData | Where-Object {$_.Name -eq 'NewPolicy'} | Select-Object -ExpandProperty '#text')"
       Write-Host "---"
   }

4. Export events to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4964} | Select-Object TimeCreated, Id, LevelDisplayName, UserId, ProcessId, Message | Export-Csv -Path "C:\Temp\Event4964.csv" -NoTypeInformation

Verify the current audit policy settings to understand the system's current configuration and compare with historical changes.

1. Open Command Prompt as Administrator
2. Display current audit policy settings:

   auditpol /get /category:*

3. Focus on object access audit policies:

   auditpol /get /subcategory:"File System" /subcategory:"Registry" /subcategory:"Kernel Object" /subcategory:"SAM" /subcategory:"Certification Services" /subcategory:"Application Generated"

4. Check Group Policy audit settings:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "AuditBaseObjects"

5. Review Local Security Policy settings by opening secpol.msc and navigating to Local Policies → Audit Policy
6. Compare current settings with the policy states recorded in Event ID 4964 to identify discrepancies

Determine if the audit policy changes originated from Group Policy updates and identify the source GPO.

1. Check Group Policy application events:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 20 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-24)}

2. Review Group Policy processing for audit policy:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-GroupPolicy/Operational'} -MaxEvents 50 | Where-Object {$_.Message -like "*audit*"}

3. Use Group Policy Results to identify applied policies:

   gpresult /h C:\Temp\GPResult.html /f

4. Check specific audit policy GPO settings:

   gpresult /z | findstr /i "audit"

5. Review domain controller event logs if in domain environment:

   Get-WinEvent -ComputerName "DC01" -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 10

6. Examine GPO modification events on domain controllers:

   Get-WinEvent -ComputerName "DC01" -FilterHashtable @{LogName='Security'; Id=5136,5137,5141} | Where-Object {$_.Message -like "*audit*"}

Perform comprehensive analysis to correlate Event ID 4964 with other security events and identify potential security implications.

1. Create a timeline of related security events:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4964; StartTime=$StartTime}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719; StartTime=$StartTime}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4902; StartTime=$StartTime}
   $Events | Sort-Object TimeCreated | Format-Table TimeCreated, Id, Message -Wrap

2. Check for privilege escalation events around the same time:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673,4674} | Where-Object {$_.TimeCreated -gt $StartTime -and $_.TimeCreated -lt $StartTime.AddHours(1)}

3. Analyze process creation events for audit policy tools:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*auditpol*" -or $_.Message -like "*secpol*"}

4. Review registry access events for audit policy keys:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Where-Object {$_.Message -like "*CurrentControlSet\Control\Lsa\Audit*"}

5. Generate comprehensive audit policy change report:

   $Report = @()
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4964} | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       $Report += [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           User = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           Domain = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           ProcessName = ($EventData | Where-Object {$_.Name -eq 'ProcessName'}).'#text'
           PreviousPolicy = ($EventData | Where-Object {$_.Name -eq 'PreviousPolicy'}).'#text'
           NewPolicy = ($EventData | Where-Object {$_.Name -eq 'NewPolicy'}).'#text'
       }
   }
   $Report | Export-Csv -Path "C:\Temp\AuditPolicyChanges.csv" -NoTypeInformation