Windows Event ID 4692: Backup of data protection master key was attempted
Windows Security Event ID 4692 records an attempted backup of a DPAPI master key.
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
DPAPI backs up user master keys to a domain controller so protected data can be recovered after password reset; the event is generated on domain controllers, member servers, and workstations.
Key Fields
MasterKeyId
Unique identifier of the master key being backed up. Microsoft states user master keys are stored under the user profile AppData roaming Protect folder named by SID.
RecoveryServer
Usually the domain controller contacted by a domain-joined machine to back up the key. Empty values can occur depending on capture conditions.
FailureReason
Hex status for the operation. Microsoft documents 0x0 as the typical success value for this event.
Common False Positives
- Normal DPAPI master-key creation and domain backup can generate this event for domain-joined users.
- Password reset and recovery workflows can trigger legitimate DPAPI backup operations.
Related Events
MITRE ATT&CK Mapping
- T1555Credentials from Password Stores
Detection Notes
Do not treat every 4692 as malicious: Microsoft says it is typically informational and tied to DPAPI master-key backup. Escalate T1555 only when the Subject account, RecoveryServer, or FailureReason departs from baseline, such as FailureReason not equal to 0x0 or a privileged account backing up many MasterKeyId values. Because Microsoft places user master-key files under %APPDATA%\Roaming\Microsoft\Windows\Protect\%SID%, correlate suspicious 4692 with file access to that AppData Protect path and Credential Manager events 5376 or 5377.
SecurityEvent
| where EventID == 4692
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId, MasterKeyId, RecoveryServer, FailureReasonindex=wineventlog EventCode=4692
| table _time, host, SubjectUserName, SubjectLogonId, MasterKeyId, RecoveryServer, FailureReasonSubject: CORP\svc-backup
Logon ID: 0x30c08
MasterKeyId: 16cfaea0-dbe3-4d92-9523-d494edb546bc
RecoveryServer: DC01.contoso.local
FailureReason: 0x0