Windows Event ID 4716: Trusted domain information was modified
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4716 records modification of Active Directory trusted domain information.
Technical Metadata
| Event ID | 4716 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1484.002 Domain or Tenant Policy Modification: Trust Modification |
| Key fields to watch | TdoType, TdoDirection, TdoAttributes / SidFilteringEnabled |
Trigger Scenarios
This event is generated on domain controllers when trust settings are modified, including trust type, direction, attributes, and SID filtering state.
Key Fields
TdoType
The new trust type. Microsoft documents values including 1 downlevel, 2 uplevel, 3 MIT Kerberos, and 4 DCE.
TdoDirection
The new trust direction. Value 0 disables the trust, 1 is inbound, 2 is outbound, and 3 is bidirectional.
TdoAttributes / SidFilteringEnabled
Trust attributes must be converted to hex for interpretation. Microsoft documents values such as 0x4 quarantined domain, 0x8 forest transitive, 0x40 treat as external, 0x80 RC4 encryption for MIT trusts, 0x200 no TGT delegation, and 0x400 PIM trust.
Threat Hunting Queries
SecurityEvent
| where EventID == 4716
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4716
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4716- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4716
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4716
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| TdoDirection | 3 | TRUST_DIRECTION_BIDIRECTIONAL: both domains trust one another. | Changing an existing trust to bidirectional expands authentication paths and requires explicit authorization. Source |
| TdoAttributes | 0x40 | TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL: a cross-forest trust is treated like an external trust for SID-filtering purposes. | Microsoft notes that this relaxes the stricter cross-forest filtering model, making an unexpected addition security-sensitive. Source |
| SidFilteringEnabled | Disabled | SID filtering is disabled for the trust. | Disabling SID filtering can allow SIDs from the trusted side to influence authorization and requires immediate review against the trust design. Source |
MITRE ATT&CK Mapping
- T1484.002Domain or Tenant Policy Modification: Trust Modification
Detection Notes
T1484.002 Trust Modification is high priority when TdoDirection changes to 3 bidirectional, TdoAttributes adds 0x40 TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL, or SidFilteringEnabled becomes Disabled. These values expand or relax the trust boundary; compare old and new settings, DomainSid, and the approved change. ANONYMOUS LOGON with Logon ID 0x3e6 can reflect automatic trust-password reset and must be correlated before escalation.
Common False Positives
- Planned forest migration, merger, or trust-hardening work can legitimately modify trust attributes.
- Microsoft documents ANONYMOUS LOGON with Logon ID 0x3E6 during automatic trust password reset; validate related 4724 or 4742 before escalating.
Related Events
- 4706 - A new trust was created to a domain
- 4724 - An attempt was made to reset an account's password
- Event ID 4742Content pending
Sample Log
EventID: 4716
SubjectUserName: dadmin
SubjectLogonId: 0x138eb0
DomainSid: S-1-5-21-2226861337-2836268956-2433141405
TdoType: 2 (Uplevel)
TdoDirection: 3 (Bidirectional)
TdoAttributes: 64 (0x40 TREAT_AS_EXTERNAL)
SidFilteringEnabled: DisabledFrequently Asked Questions
What does Windows Event ID 4716 mean?
Event ID 4716 records modification of Active Directory trusted-domain information and includes old and new trust settings when available.
Why is TdoAttributes 0x40 sensitive?
TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL relaxes cross-forest SID-filtering treatment to the external-trust model, so an unexpected addition can change authorization boundaries.
Is an ANONYMOUS LOGON subject always malicious in 4716?
No. Microsoft documents that ANONYMOUS LOGON can appear during automatic trust-password reset; correlate that pattern with expected trust maintenance before escalating.
Sources
- 4716: Microsoft Windows security auditing event reference
Microsoft · vendor
- Domain or Tenant Policy Modification: Trust Modification (T1484.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule