Event ID 4719: system audit policy changed
What Event ID 4719 (system audit policy changed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4719 means the system's audit policy changed. Attackers who know what they are doing turn auditing down before the noisy part of an intrusion, so a 4719 that removes success or failure logging from key categories is a strong sign someone wants the SOC blind. The good news: the change itself is logged, and it is rare outside Group Policy updates.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject > Account Name | Who changed it. The machine account or SYSTEM usually means Group Policy did it. |
| Category / Subcategory | Which part of auditing changed, for example Logon/Logoff > Logon, or Detailed Tracking > Process Creation. |
| Changes | Success removed or Failure removed reduces logging. Success added increases it. |
What is normal
A burst of 4719 events, written by SYSTEM, when a new audit GPO is first applied or changed. They match a change your team made on purpose.
When Event ID 4719 is suspicious
- Success or failure removed from Logon, Process Creation, Account Management or Audit Policy Change, by a user account.
auditpol.exewith/clear,/removeor/set ... /success:disablein process creation logs (4688 or Sysmon 1) just before the 4719.- A 4719 on a domain controller or server that nobody can match to a GPO change.
- A 4719 followed by the Security log going quiet, or by Event ID 1102 (log cleared).
Common false positive: A badly scoped GPO, or two GPOs that disagree, can flip audit settings back and forth on every refresh. If you see the same 4719 every 90 minutes, look at Group Policy before you look for an attacker.
Find Event ID 4719 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4719
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 1102: Security audit log cleared
- Event ID 4688: New process created
- Sysmon Event ID 1: process creation
FAQ
How do I see the current audit policy?
Run auditpol /get /category:* in an elevated prompt. It shows the effective setting for every subcategory.
Can an attacker change the audit policy without a 4719?
Changing it through the normal APIs writes 4719. Tampering with the policy files directly or stopping the event log service leaves other traces, such as a gap in events or System Event ID 1100.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.