SOC Event Lookup
Event ID 4692DPAPIP3

Windows Event ID 4692: Backup of data protection master key was attempted

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4692 records an attempted backup of a DPAPI master key.

Technical Metadata

Technical metadata for Event ID 4692
Event ID4692
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0006 Credential Access / T1555 Credentials from Password Stores
Key fields to watchMasterKeyId, RecoveryServer, FailureReason

Trigger Scenarios

DPAPI backs up user master keys to a domain controller so protected data can be recovered after password reset; the event is generated on domain controllers, member servers, and workstations.

Key Fields

MasterKeyId

Unique identifier of the master key being backed up. Microsoft states user master keys are stored under the user profile AppData roaming Protect folder named by SID.

RecoveryServer

Usually the domain controller contacted by a domain-joined machine to back up the key. Empty values can occur depending on capture conditions.

FailureReason

Hex status for the operation. Microsoft documents 0x0 as the typical success value for this event.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4692
SecurityEvent
| where EventID == 4692
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4692
index=wineventlog source="WinEventLog:Security" EventCode=4692
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4692
dataset = microsoft_windows_raw
| filter edr_event_id = 4692
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4692
title: Windows Security Event ID 4692
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4692
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
StatusCode0x0Microsoft documents 0x0 as the typical success status for DPAPI master-key backup.Interpret StatusCode with the complete event and correlated activity; this value alone is not proof of compromise. Source
RecoveryKeyIdidentifierIdentifies the recovery key used for the backup operation.Interpret RecoveryKeyId with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1555Credentials from Password Stores

Detection Notes

Do not treat every 4692 as malicious: Microsoft says it is typically informational and tied to DPAPI master-key backup. Escalate T1555 only when the Subject account, RecoveryServer, or FailureReason departs from baseline, such as FailureReason not equal to 0x0 or a privileged account backing up many MasterKeyId values. Because Microsoft places user master-key files under %APPDATA%\Roaming\Microsoft\Windows\Protect\%SID%, correlate suspicious 4692 with file access to that AppData Protect path and Credential Manager events 5376 or 5377.

Common False Positives

  • Normal DPAPI master-key creation and domain backup can generate this event for domain-joined users.
  • Password reset and recovery workflows can trigger legitimate DPAPI backup operations.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\svc-backup
Logon ID: 0x30c08
MasterKeyId: 16cfaea0-dbe3-4d92-9523-d494edb546bc
RecoveryServer: DC01.contoso.local
FailureReason: 0x0

Frequently Asked Questions

What does Windows Event ID 4692 mean?

A backup of a DPAPI master key was attempted.

Does Event ID 4692 always indicate malicious activity?

No. Domain-joined systems periodically back up DPAPI master keys for account recovery.

How should Event ID 4692 be investigated?

Inspect status, recovery server and key identifiers and correlate unusual volume or actors with profile and credential activity.

Sources