SOC Event Lookup
Event ID 4719AuditPolicyP1

Windows Event ID 4719: System audit policy was changed

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4719 records a system audit policy change and can reveal attempts to reduce logging before malicious activity.

Technical Metadata

Technical metadata for Event ID 4719
Event ID4719
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1562.002 Impair Defenses: Disable Windows Event Logging
Key fields to watchAudit Policy Changes, Subject, Computer

Trigger Scenarios

Windows logs the event when one or more audit subcategories are enabled or disabled through policy or local configuration.

Key Fields

Audit Policy Changes

The subcategories and success or failure settings that changed. Disabling process, logon, or policy auditing is especially significant.

Subject

The account that changed policy. Confirm that the action matches approved administration.

Computer

The affected system. Changes on domain controllers and management servers have broad investigative impact.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4719
SecurityEvent
| where EventID == 4719
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4719
index=wineventlog source="WinEventLog:Security" EventCode=4719
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4719
dataset = microsoft_windows_raw
| filter edr_event_id = 4719
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4719
title: Windows Event ID 4719
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4719
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
AuditPolicyChanges%%8448Success auditing was removed for the named audit subcategory.Removing success auditing can suppress evidence such as successful logons or process creation, depending on the affected subcategory. Source
AuditPolicyChanges%%8450Failure auditing was removed for the named audit subcategory.Removing failure auditing can hide rejected authentication or access attempts for the affected subcategory. Source

MITRE ATT&CK Mapping

  • T1562.002Impair Defenses: Disable Windows Event Logging

Detection Notes

T1562.002 occurs when Audit Policy Changes removes Success or Failure for Audit Process Creation, Logon, or other security-critical audit subcategories. Disabling both Success and Failure is materially different from enabling a category because it removes future visibility. Use a local correlation window=60 minutes to connect the same Subject Logon ID to 4688 policy-change tooling and any following 1102 log clear.

Common False Positives

  • Hardening projects and Group Policy deployments can legitimately change audit settings.
  • Operating-system upgrades or baseline changes may modify multiple subcategories at once.

Related Events

Sample Log

Sanitized event sample
Subject: Account Name: CORP\admin.ops
Audit Policy Changes: Audit Process Creation: Success removed
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 4719 mean?

Event ID 4719 records a change to the computer's system audit policy and identifies the changed audit subcategory and whether success or failure auditing was added or removed.

Why can 4719 appear even when audit policy settings change?

Microsoft states that this event is generated regardless of the Audit Policy Change subcategory setting, helping retain evidence of audit-policy modification.

Which 4719 changes are highest priority?

Unexpected removal of success or failure auditing from security-critical subcategories is higher risk than approved additions; verify the subject, subcategory GUID, policy deployment source, and nearby process activity.

Sources