Windows Event ID 4706: A new trust was created to a domain
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4706 records that a new Active Directory domain trust was created on a domain controller, logging the new trust's target domain, type, direction, and attribute bitmask.
Technical Metadata
| Event ID | 4706 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1484.002 Domain or Tenant Policy Modification: Trust Modification |
| Key fields to watch | Trust Information\Trust Type, Trust Information\Trust Direction, Trust Information\Trust Attributes, New Domain\Domain Name / Domain SID |
Trigger Scenarios
A domain administrator runs netdom, the Active Directory Domains and Trusts console, or PowerShell to create a trust between the local domain and another. This is a low-frequency infrastructure operation and should only occur during planned directory changes.
Key Fields
Trust Information\Trust Type
The trust implementation type. Microsoft defines 1 as downlevel, 2 as uplevel Windows, 3 as MIT Kerberos, and 4 as DCE; forest scope is represented by the 0x8 FOREST_TRANSITIVE attribute, not Trust Type 2.
Trust Information\Trust Direction
The trust direction. Value 0 is disabled, 1 means the trusted domain trusts the primary domain, 2 means the primary domain trusts the trusted domain, and 3 is bidirectional.
Trust Information\Trust Attributes
A bitmask of additional trust properties. Bit 0x8 (FOREST_TRANSITIVE) means the trust is transitive across the entire trusted forest. Bit 0x10 (CROSS_ORGANIZATION) marks trusts across separate organizations. An unexpected 0x8 or 0x10 value in a new trust should be validated against the change ticket before the domain controller replicates the object.
New Domain\Domain Name / Domain SID
The trusted domain's name and SID. Verify these against the expected target domain documented in the change-management record; an unfamiliar domain name or SID indicates an unauthorized trust.
Threat Hunting Queries
SecurityEvent
| where EventID == 4706
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4706
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4706- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4706
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4706
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| TdoType | 2 | TRUST_TYPE_UPLEVEL: the trusted domain runs Windows 2000 or later. | This is the common Windows-domain trust type, not a synonym for forest trust; scope is determined by direction and attribute bits. Source |
| TdoDirection | 3 | TRUST_DIRECTION_BIDIRECTIONAL: both domains trust one another for authentication and name lookups. | An unapproved bidirectional trust expands authentication paths in both directions and has greater exposure than a one-way trust. Source |
| TdoAttributes | 0x8 | TRUST_ATTRIBUTE_FOREST_TRANSITIVE: the trust is a cross-forest trust between forest root domains. | This bit establishes forest-transitive scope and must match the approved partner forest and SID-filtering design. Source |
MITRE ATT&CK Mapping
- T1484.002Domain or Tenant Policy Modification: Trust Modification
Detection Notes
T1484.002 Trust Modification applies to unapproved trust creation. Validate TdoType 2 as an uplevel Windows-domain trust, TdoDirection 3 as bidirectional, and TdoAttributes 0x8 as forest transitive; these values are distinct and must not be conflated. Compare DomainSid and SidFilteringEnabled with the approved partner and change record, then correlate SubjectLogonId to the creating administrator session.
Common False Positives
- Planned Active Directory forest consolidations and organizational mergers create domain trusts with appropriate change-management approval.
- Azure AD Connect or hybrid identity configurations create specific trust objects that are expected in hybrid deployments.
Related Events
- Event ID 4707Content pending
Sample Log
Subject:
Security ID: CORP\svc-admin
Account Name: svc-admin
Account Domain: CORP
Logon ID: 0x3F1E0
New Domain:
Domain Name: partner.example
Domain SID: S-1-5-21-9999999999-9999999999-9999999999
Trust Information:
Trust Type: 2 (Uplevel)
Trust Direction: 3 (Bidirectional)
Trust Attributes: 8 (0x8 FOREST_TRANSITIVE)Frequently Asked Questions
What does Windows Event ID 4706 mean?
Event ID 4706 records creation of an Active Directory domain trust and includes the actor, trusted-domain identity, trust type, direction, attributes, and SID-filtering state.
Does Trust Type 2 mean a forest trust?
No. Microsoft defines value 2 as TRUST_TYPE_UPLEVEL for Windows 2000 or later; the 0x8 FOREST_TRANSITIVE attribute identifies cross-forest trust scope.
Which 4706 values deserve immediate validation?
Every unplanned trust creation is high priority; specifically validate DomainSid, TdoDirection 3 bidirectional scope, TdoAttributes bits such as 0x8, and whether SID filtering is enabled.
Sources
- 4706: Microsoft Windows security auditing event reference
Microsoft · vendor
- Domain or Tenant Policy Modification: Trust Modification (T1484.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule