SOC Event Lookup
Event ID 4716TrustP2

Windows Event ID 4716: Trusted domain information was modified

Windows Security Event ID 4716 records modification of Active Directory trusted domain information.

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-13

Trigger Scenarios

This event is generated on domain controllers when trust settings are modified, including trust type, direction, attributes, and SID filtering state.

Key Fields

TdoType

The new trust type. Microsoft documents values including 1 downlevel, 2 uplevel, 3 MIT Kerberos, and 4 DCE.

TdoDirection

The new trust direction. Value 0 disables the trust, 1 is inbound, 2 is outbound, and 3 is bidirectional.

TdoAttributes / SidFilteringEnabled

Trust attributes must be converted to hex for interpretation. Microsoft documents values such as 0x4 quarantined domain, 0x8 forest transitive, 0x40 treat as external, 0x80 RC4 encryption for MIT trusts, 0x200 no TGT delegation, and 0x400 PIM trust.

Common False Positives

  • Planned forest migration, merger, or trust-hardening work can legitimately modify trust attributes.
  • Microsoft documents ANONYMOUS LOGON with Logon ID 0x3E6 during automatic trust password reset; validate related 4724 or 4742 before escalating.

Related Events

MITRE ATT&CK Mapping

  • T1484.002Domain Policy Modification: Trust Modification

Detection Notes

Alert on threshold=1 unplanned 4716 because MITRE T1484.002 covers adversaries modifying domain trust settings to elevate privileges or evade defenses. Prioritize TdoDirection=3, TdoAttributes adding 0x8 forest transitive, 0x40 treat-as-external, 0x80 RC4 on MIT trusts, or 0x400 PIM trust, and any SidFilteringEnabled=Disabled value. Microsoft documents ANONYMOUS LOGON with Logon ID 0x3E6 as possible automatic trust password reset, so correlate with 4724/4742 before treating that specific pattern as malicious.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4716
| project TimeGenerated, Computer, Account
Splunk SPL
index=wineventlog EventCode=4716 | table _time, host
Sample Log
EventID: 4716
SubjectUserName: dadmin
SubjectLogonId: 0x138eb0
DomainSid: S-1-5-21-2226861337-2836268956-2433141405
TdoType: 2
TdoDirection: 3
TdoAttributes: 64
SidFilteringEnabled: Disabled

Source

Official documentationMachine-readable JSON