SOC Event Lookup
Event ID 4715PolicyP2

Windows Event ID 4715: The audit policy (SACL) on an object was changed

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4715 records a change to the local audit policy security descriptor.

Technical Metadata

Technical metadata for Event ID 4715
Event ID4715
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1562.002 Impair Defenses: Disable Windows Event Logging
Key fields to watchOldSd / NewSd, SubjectUserName / SubjectLogonId, SDDL rights and flags

Trigger Scenarios

This event is generated every time the local audit policy security descriptor changes and is logged regardless of the Audit Policy Change subcategory setting.

Key Fields

OldSd / NewSd

The original and new Security Descriptor Definition Language strings for the audit policy. Removing SACL entries such as AU with SA or FA can reduce success or failure auditing.

SubjectUserName / SubjectLogonId

Identifies the account and hexadecimal logon session that changed the audit policy security descriptor.

SDDL rights and flags

Microsoft documents SDDL elements including S: for SACL, SA for successful access audit, FA for failed access audit, WD for Modify Permissions, WO for Modify Owner, and hex rights such as 0xf0007.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4715
SecurityEvent
| where EventID == 4715
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4715
index=wineventlog source="WinEventLog:Security" EventCode=4715
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4715
dataset = microsoft_windows_raw
| filter edr_event_id = 4715
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4715
title: Windows Security Event ID 4715
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4715
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
NewSdS:NO_ACCESS_CONTROLThe new security descriptor contains no SACL access-control entries.On a high-value audited object, replacing a populated SACL with no audit controls removes object-access evidence and supports defense-impairment triage. Source
SDDL audit flagSA/FASA and FA request successful-access and failed-access auditing in a SACL ACE.Removal of these flags from a relevant ACE can suppress the corresponding object-access audit outcomes. Source

MITRE ATT&CK Mapping

  • T1562.002Impair Defenses: Disable Windows Event Logging

Detection Notes

Use threshold=1 for an unplanned 4715 on a high-value object. T1562.002 defense impairment is supported when OldSd contains SACL audit ACEs but NewSd becomes S:NO_ACCESS_CONTROL or removes SA/FA audit flags and relevant rights; compare the full SDDL and correlate SubjectLogonId with 4624 and nearby 4719 policy changes.

Common False Positives

  • Approved audit delegation changes can legitimately change OldSd and NewSd.
  • Security baseline deployment tools may reset the descriptor during controlled hardening windows.

Related Events

Sample Log

Sanitized event sample
EventID: 4715
SubjectUserName: dadmin
SubjectLogonId: 0x11ae30
OldSd: D:(A;;DCSWRPDTRC;;;BA)S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
NewSd: D:(A;;DCSWRPDTRC;;;BA)S:NO_ACCESS_CONTROL

Frequently Asked Questions

What does Windows Event ID 4715 mean?

Event ID 4715 records that the audit policy security descriptor, or SACL, on an object changed and includes the old and new SDDL.

Does every SACL change disable logging?

No. Changes can add, remove, or refine auditing; compare OldSd and NewSd and identify which trustees, rights, inheritance flags, and success or failure audit flags changed.

Why is S:NO_ACCESS_CONTROL important?

It represents a security descriptor with no SACL access-control entries, so replacing a populated audit policy with this value can remove object-access audit coverage.

Sources