Windows Event ID 4714: Encrypted data recovery policy was changed
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4714 records that the Encrypting File System data recovery agent policy changed.
Technical Metadata
| Event ID | 4714 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| MITRE ATT&CK | TA0112 Defense Impairment / T1484.001 Domain or Tenant Policy Modification: Group Policy Modification |
| Key fields to watch | EFS policy registry value, Computer, TimeCreated |
Trigger Scenarios
The event is generated when an EFS Data Recovery Agent certificate or policy changes for the computer or device, including during Group Policy update.
Key Fields
EFS policy registry value
Microsoft states the event is generated in the background when HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob changes during Group Policy update.
Computer
The system receiving the EFS recovery-policy change. Prioritize servers storing sensitive encrypted files.
TimeCreated
The time of policy application. Use it to locate the GPO update or certificate change that introduced the recovery policy.
Threat Hunting Queries
SecurityEvent
| where EventID == 4714
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
index=wineventlog source="WinEventLog:Security" EventCode=4714
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 4714- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4714
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4714
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| RegistryPath | HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob | The Microsoft-documented policy value associated with EFS recovery policy application. | Interpret RegistryPath with the complete event and correlated activity; this value alone is not proof of compromise. Source |
| EventID | 4714 | The encrypted-data recovery policy changed. | Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1484.001Domain or Tenant Policy Modification: Group Policy Modification
Detection Notes
Treat unexpected 4714 as T1484.001 when it coincides with an unapproved change to HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob, the Microsoft-documented registry value behind EFS recovery policy application. An attacker-controlled recovery agent can make future EFS-protected file recovery possible through policy rather than file-by-file access. Correlate with 4657 on the same HKLM path, GPO change records, and 6145 errors that may indicate policy processing anomalies.
Common False Positives
- Planned EFS recovery-agent certificate rotation or Group Policy maintenance can generate this event.
- Baseline application on newly built hosts can apply the same recovery policy repeatedly.
Related Events
Sample Log
Encrypted data recovery policy was changed.
Computer: FILE01
Registry value: HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlobFrequently Asked Questions
What does Windows Event ID 4714 mean?
An encrypted-data recovery policy was changed.
Does Event ID 4714 always indicate malicious activity?
No. Authorized EFS recovery-agent and Group Policy maintenance can generate it.
How should Event ID 4714 be investigated?
Validate the EFS recovery-agent policy, certificate owners, GPO provenance and correlated registry changes.
Sources
- 4714: Encrypted data recovery policy was changed
Microsoft · vendor
- Domain or Tenant Policy Modification: Group Policy Modification (T1484.001)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule