Event ID 4794DSRMP1

Windows Event ID 4794: An attempt was made to set the Directory Services Restore Mode administrator password

Event ID 4794 records an attempt to set the Directory Services Restore Mode (DSRM) local administrator password on a domain controller. It is a rare, high-signal Windows Security event.

Applicable version: Windows Server 2008 R2 and later
Last reviewed: 2026-07-11

Trigger Scenarios

It fires when a process invokes the DSRM password-setting operation on a domain controller, most commonly through ntdsutil.exe. Outside scheduled disaster-recovery testing, it should be exceptional.

Key Fields

Subject

The account initiating the operation. It must map to an authorized domain controller administrator and a known change ticket.

Process Name

ntdsutil.exe is the standard tool for this operation. Any other initiating process requires immediate scrutiny.

Computer

The affected domain controller. Check the DsrmAdminLogonBehavior registry value on this same host before classifying activity as maintenance.

Common False Positives

Ticketed disaster-recovery drills that rotate the DSRM password are the usual legitimate source.
New domain controller promotion can set an initial DSRM password during a documented deployment window.

Related Events

MITRE ATT&CK Mapping

T1098Account Manipulation
T1556Modify Authentication Process

Detection Notes

4794 can expose a specific T1098/T1556 persistence technique: an attacker with domain-admin rights sets the DSRM password with ntdsutil and changes HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior to 1 or 2. A non-zero value permits the built-in DSRM local administrator to authenticate over the network to the domain controller. That local SAM account survives ordinary domain-password resets and some domain-account containment steps. Treat an unexpected 4794 as active persistence: verify the operator and change ticket, then inspect DsrmAdminLogonBehavior immediately. A non-zero unapproved value is a likely backdoor, not configuration drift.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4794
| project TimeGenerated, Computer, Account, ProcessName, SubjectLogonId
| order by TimeGenerated desc

Splunk SPL

index=wineventlog EventCode=4794
| table _time, host, Subject_User_Name, Process_Name

Sample Log

Subject: CORP\admin.ops
Process Name: C:\Windows\System32\ntdsutil.exe
Computer: DC01.corp.example

Source

Official documentation Machine-readable JSON