SOC Event Lookup
Event ID 4713PolicyP3

Windows Event ID 4713: Kerberos policy was changed

Applicable version
Windows Server 2008 and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4713 records a Kerberos policy change on a domain controller.

Technical Metadata

Technical metadata for Event ID 4713
Event ID4713
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
Key fields to watchKerberosPolicyChange, KerOpts, Subject

Trigger Scenarios

The event is generated only on domain controllers when Kerberos policy values are changed through domain policy.

Key Fields

KerberosPolicyChange

The field lists changed parameters as Parameter_Name: new_value (old_value). Microsoft documents KerMaxT, KerMaxR, KerMinT, KerProxy, and KerOpts.

KerOpts

Enforce user logon restrictions. Microsoft documents 0x80 as Enabled and 0x0 as Disabled; disabling it weakens Kerberos logon restriction enforcement.

Subject

The account that made the change. Validate whether it is an approved domain-policy administrator and whether the change was scheduled.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4713
SecurityEvent
| where EventID == 4713
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4713
index=wineventlog source="WinEventLog:Security" EventCode=4713
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4713
dataset = microsoft_windows_raw
| filter edr_event_id = 4713
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4713
title: Windows Security Event ID 4713
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4713
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
KerOpts0x80Microsoft documents this value as Enforce user logon restrictions enabled.Interpret KerOpts with the complete event and correlated activity; this value alone is not proof of compromise. Source
KerOpts0x0Microsoft documents this value as Enforce user logon restrictions disabled.Interpret KerOpts with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1484.001Domain or Tenant Policy Modification: Group Policy Modification

Detection Notes

Alert on unplanned 4713 where KerberosPolicyChange sets KerOpts to 0x0, because Microsoft documents 0x80 as Enforce user logon restrictions enabled and 0x0 as disabled. That is a concrete T1484.001 signal: a domain Kerberos policy change weakens centrally managed authentication behavior. Also review large KerMaxT or KerMaxR increases because Microsoft documents the conversion formulas for ticket and renewal lifetime; correlate the Subject Logon ID to 4624 and administrative change tickets.

Common False Positives

  • Planned domain hardening, Kerberos lifetime tuning, or Group Policy maintenance can legitimately generate 4713.
  • Domain controller promotion or baseline rebuilds may reapply Kerberos policy values.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\admin.ops
Logon ID: 0x3e7
KerberosPolicyChange: KerOpts: 0x0 (0x80); KerMaxT: 0x10c388d000 (0x861c46800);

Frequently Asked Questions

What does Windows Event ID 4713 mean?

Kerberos policy for the domain was changed.

Does Event ID 4713 always indicate malicious activity?

No. Authorized domain policy administration can generate it.

How should Event ID 4713 be investigated?

Compare old and new policy values, identify the subject logon, and validate the responsible GPO and change record.

Sources