SOC Event Lookup
Event ID 4794DSRMP1

Windows Event ID 4794: An attempt was made to set the Directory Services Restore Mode administrator password

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4794 records an attempt to set the Directory Services Restore Mode (DSRM) local administrator password on a domain controller. It is a rare, high-signal Windows Security event.

Technical Metadata

Technical metadata for Event ID 4794
Event ID4794
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0003 Persistence / T1098 Account Manipulation
Key fields to watchSubject, Workstation, Status

Trigger Scenarios

It is generated when an account attempts to set the DSRM administrator password on a domain controller. Outside scheduled disaster-recovery or domain-controller maintenance, it should be exceptional.

Key Fields

Subject

The account initiating the operation. It must map to an authorized domain controller administrator and a known change ticket.

Workstation

The computer name from which the password-setting attempt originated. Compare it with approved domain-controller administration hosts.

Status

The hexadecimal result of the attempt. Status 0x0 means the operation succeeded; other values require Windows error-code interpretation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4794
SecurityEvent
| where EventID == 4794
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4794
index=wineventlog source="WinEventLog:Security" EventCode=4794
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4794
dataset = microsoft_windows_raw
| filter edr_event_id = 4794
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4794
title: Windows Security Event ID 4794
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4794
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Status0x0The attempt to set the DSRM administrator password succeeded.A successful operation outside an approved recovery-maintenance workflow changes a sensitive domain-controller recovery credential and requires immediate validation. Source

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

T1098 Account Manipulation applies when an unauthorized operator attempts to set the Directory Services Restore Mode administrator password. Treat one unexpected 4794 on a domain controller as high priority: Status 0x0 means the operation succeeded, so confirm SubjectUserName, SubjectLogonId, and Workstation against an approved recovery-maintenance change; nonzero status values still warrant review as attempted access.

Common False Positives

  • Ticketed disaster-recovery drills that rotate the DSRM password are the usual legitimate source.
  • New domain controller promotion can set an initial DSRM password during a documented deployment window.

Related Events

Sample Log

Sanitized event sample
Subject: Account Name: CORP\admin.ops
Logon ID: 0x36f67
Workstation: DC01
Status: 0x0

Frequently Asked Questions

What does Windows Event ID 4794 mean?

Event ID 4794 records an attempt to set the Directory Services Restore Mode administrator password on a domain controller and includes the actor, originating workstation, and status.

Does 4794 show whether the password-reset attempt succeeded?

Yes. Status 0x0 means the operation succeeded; a nonzero status represents a failed attempt that should be interpreted using the corresponding Windows error code.

Why is DSRM password activity sensitive?

The DSRM administrator is a local recovery account on a domain controller, so changing its password affects a credential that is separate from ordinary domain-account passwords and should be tightly controlled.

Sources