SOC Event Lookup
Event ID 4716TrustP2

Windows Event ID 4716: Trusted domain information was modified

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4716 records modification of Active Directory trusted domain information.

Technical Metadata

Technical metadata for Event ID 4716
Event ID4716
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0004 Privilege Escalation / T1484.002 Domain or Tenant Policy Modification: Trust Modification
Key fields to watchTdoType, TdoDirection, TdoAttributes / SidFilteringEnabled

Trigger Scenarios

This event is generated on domain controllers when trust settings are modified, including trust type, direction, attributes, and SID filtering state.

Key Fields

TdoType

The new trust type. Microsoft documents values including 1 downlevel, 2 uplevel, 3 MIT Kerberos, and 4 DCE.

TdoDirection

The new trust direction. Value 0 disables the trust, 1 is inbound, 2 is outbound, and 3 is bidirectional.

TdoAttributes / SidFilteringEnabled

Trust attributes must be converted to hex for interpretation. Microsoft documents values such as 0x4 quarantined domain, 0x8 forest transitive, 0x40 treat as external, 0x80 RC4 encryption for MIT trusts, 0x200 no TGT delegation, and 0x400 PIM trust.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4716
SecurityEvent
| where EventID == 4716
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4716
index=wineventlog source="WinEventLog:Security" EventCode=4716
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4716
dataset = microsoft_windows_raw
| filter edr_event_id = 4716
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4716
title: Windows Security Event ID 4716
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4716
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TdoDirection3TRUST_DIRECTION_BIDIRECTIONAL: both domains trust one another.Changing an existing trust to bidirectional expands authentication paths and requires explicit authorization. Source
TdoAttributes0x40TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL: a cross-forest trust is treated like an external trust for SID-filtering purposes.Microsoft notes that this relaxes the stricter cross-forest filtering model, making an unexpected addition security-sensitive. Source
SidFilteringEnabledDisabledSID filtering is disabled for the trust.Disabling SID filtering can allow SIDs from the trusted side to influence authorization and requires immediate review against the trust design. Source

MITRE ATT&CK Mapping

  • T1484.002Domain or Tenant Policy Modification: Trust Modification

Detection Notes

T1484.002 Trust Modification is high priority when TdoDirection changes to 3 bidirectional, TdoAttributes adds 0x40 TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL, or SidFilteringEnabled becomes Disabled. These values expand or relax the trust boundary; compare old and new settings, DomainSid, and the approved change. ANONYMOUS LOGON with Logon ID 0x3e6 can reflect automatic trust-password reset and must be correlated before escalation.

Common False Positives

  • Planned forest migration, merger, or trust-hardening work can legitimately modify trust attributes.
  • Microsoft documents ANONYMOUS LOGON with Logon ID 0x3E6 during automatic trust password reset; validate related 4724 or 4742 before escalating.

Related Events

Sample Log

Sanitized event sample
EventID: 4716
SubjectUserName: dadmin
SubjectLogonId: 0x138eb0
DomainSid: S-1-5-21-2226861337-2836268956-2433141405
TdoType: 2 (Uplevel)
TdoDirection: 3 (Bidirectional)
TdoAttributes: 64 (0x40 TREAT_AS_EXTERNAL)
SidFilteringEnabled: Disabled

Frequently Asked Questions

What does Windows Event ID 4716 mean?

Event ID 4716 records modification of Active Directory trusted-domain information and includes old and new trust settings when available.

Why is TdoAttributes 0x40 sensitive?

TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL relaxes cross-forest SID-filtering treatment to the external-trust model, so an unexpected addition can change authorization boundaries.

Is an ANONYMOUS LOGON subject always malicious in 4716?

No. Microsoft documents that ANONYMOUS LOGON can appear during automatic trust-password reset; correlate that pattern with expected trust maintenance before escalating.

Sources