SOC Event Lookup
Event ID 4693DPAPIP3

Windows Event ID 4693: Recovery of data protection master key was attempted

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4693 records an attempted recovery of a DPAPI master key.

Technical Metadata

Technical metadata for Event ID 4693
Event ID4693
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0006 Credential Access / T1555 Credentials from Password Stores
Key fields to watchMasterKeyId, RecoveryReason, FailureId

Trigger Scenarios

When DPAPI cannot unprotect data with the user password-protected master key, it can send the backup master key to a domain controller for recovery by protected RPC.

Key Fields

MasterKeyId

Unique identifier of the recovered master key. Microsoft documents that the master-key file name is the ID under the user Protect folder.

RecoveryReason

Hex code for the recovery reason. Microsoft examples show RecoveryReason 0x5c005c and note that this field can contain Recovery Server information.

FailureId

Hex status for the operation. Microsoft documents 0x380000 as the typical success value.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4693
SecurityEvent
| where EventID == 4693
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4693
index=wineventlog source="WinEventLog:Security" EventCode=4693
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4693
dataset = microsoft_windows_raw
| filter edr_event_id = 4693
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4693
title: Windows Security Event ID 4693
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4693
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
StatusCode0x380000Microsoft documents this as the typical success status for DPAPI master-key recovery.Interpret StatusCode with the complete event and correlated activity; this value alone is not proof of compromise. Source
RecoveryReasonHexInt32The documented recovery-reason field, which commonly contains recovery-server information.Interpret RecoveryReason with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1555Credentials from Password Stores

Detection Notes

Microsoft says 4693 is mainly DPAPI troubleshooting, so escalate T1555 only when the actor and reason are unusual. FailureId 0x380000 is the documented success value and RecoveryReason is a HexInt32; a successful recovery by an unexpected admin or service account means a DPAPI master key was recovered and could unlock secrets protected under %APPDATA%\Roaming\Microsoft\Windows\Protect\%SID%. Correlate MasterKeyId to the user profile path and review 4624, 4692, 5377, and file-access telemetry around the same logon session.

Common False Positives

  • Legitimate DPAPI recovery can occur after password reset, domain recovery operations, or troubleshooting.
  • Recovery Server field behavior can be confusing because Microsoft notes it can contain Recovery Reason information in this event.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\dadmin
Logon ID: 0x30d7c
MasterKeyId: 0445c766-75f0-4de7-82ad-d9d97aad59f6
RecoveryReason: 0x5c005c
RecoveryServer: DC01.contoso.local
FailureId: 0x380000

Frequently Asked Questions

What does Windows Event ID 4693 mean?

Recovery of a DPAPI master key was attempted.

Does Event ID 4693 always indicate malicious activity?

No. Microsoft describes this primarily as informational troubleshooting telemetry.

How should Event ID 4693 be investigated?

Validate recovery server, status, actor and MasterKeyId and correlate with logon and protected-data access.

Sources