SOC Event Lookup
Event ID 4714PolicyP3

Windows Event ID 4714: Encrypted data recovery policy was changed

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4714 records that the Encrypting File System data recovery agent policy changed.

Technical Metadata

Technical metadata for Event ID 4714
Event ID4714
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
Key fields to watchEFS policy registry value, Computer, TimeCreated

Trigger Scenarios

The event is generated when an EFS Data Recovery Agent certificate or policy changes for the computer or device, including during Group Policy update.

Key Fields

EFS policy registry value

Microsoft states the event is generated in the background when HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob changes during Group Policy update.

Computer

The system receiving the EFS recovery-policy change. Prioritize servers storing sensitive encrypted files.

TimeCreated

The time of policy application. Use it to locate the GPO update or certificate change that introduced the recovery policy.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4714
SecurityEvent
| where EventID == 4714
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4714
index=wineventlog source="WinEventLog:Security" EventCode=4714
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4714
dataset = microsoft_windows_raw
| filter edr_event_id = 4714
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4714
title: Windows Security Event ID 4714
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4714
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
RegistryPathHKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlobThe Microsoft-documented policy value associated with EFS recovery policy application.Interpret RegistryPath with the complete event and correlated activity; this value alone is not proof of compromise. Source
EventID4714The encrypted-data recovery policy changed.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1484.001Domain or Tenant Policy Modification: Group Policy Modification

Detection Notes

Treat unexpected 4714 as T1484.001 when it coincides with an unapproved change to HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob, the Microsoft-documented registry value behind EFS recovery policy application. An attacker-controlled recovery agent can make future EFS-protected file recovery possible through policy rather than file-by-file access. Correlate with 4657 on the same HKLM path, GPO change records, and 6145 errors that may indicate policy processing anomalies.

Common False Positives

  • Planned EFS recovery-agent certificate rotation or Group Policy maintenance can generate this event.
  • Baseline application on newly built hosts can apply the same recovery policy repeatedly.

Related Events

Sample Log

Sanitized event sample
Encrypted data recovery policy was changed.
Computer: FILE01
Registry value: HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob

Frequently Asked Questions

What does Windows Event ID 4714 mean?

An encrypted-data recovery policy was changed.

Does Event ID 4714 always indicate malicious activity?

No. Authorized EFS recovery-agent and Group Policy maintenance can generate it.

How should Event ID 4714 be investigated?

Validate the EFS recovery-agent policy, certificate owners, GPO provenance and correlated registry changes.

Sources