SOC Event Lookup
Event ID 4907PolicyP3

Windows Event ID 4907: Auditing settings on object were changed

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4907 records a change to the SACL auditing settings on a file or registry object.

Technical Metadata

Technical metadata for Event ID 4907
Event ID4907
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log
Key fields to watchObject Server / Object Type / Object Name, OldSd / NewSd, Process ID / Process Name

Trigger Scenarios

Microsoft documents that this event is generated when an object SACL changes and does not generate for Active Directory objects.

Key Fields

Object Server / Object Type / Object Name

Identifies the object whose auditing settings changed; file and registry paths are the primary investigation pivots.

OldSd / NewSd

Original and new SDDL strings for the object auditing settings.

Process ID / Process Name

The process through which the SACL change occurred.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4907
SecurityEvent
| where EventID == 4907
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4907
index=wineventlog source="WinEventLog:Security" EventCode=4907
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4907
dataset = microsoft_windows_raw
| filter edr_event_id = 4907
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4907
title: Windows Security Event ID 4907
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4907
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
OldSdSDDLThe previous system access control list for comparison.Interpret OldSd with the complete event and correlated activity; this value alone is not proof of compromise. Source
NewSdSDDLThe new SACL; removed SA or FA audit entries can reduce visibility.Interpret NewSd with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Detection Notes

Alert when Object Name is C:\Windows\System32, C:\ProgramData\, C:\Users\Public, or a critical registry key and NewSd removes SACL audit entries such as SA/FA that were present in OldSd. Microsoft documents 4907 as object SACL-change telemetry and excludes Active Directory objects; removing auditing from high-value file or registry paths impairs evidence collection and supports T1685.001 Disable or Modify Windows Event Log. Correlate Process ID to 4688 and compare with 4670 permission changes.

Common False Positives

  • Security baseline deployment and audit policy hardening can legitimately change SACLs.
  • Administrators may update auditing on sensitive folders during compliance work.

Related Events

Sample Log

Sanitized event sample
EventID: 4907
Object Type: File
Object Name: C:\ProgramData\SecurityAgent\logs
OldSd: S:(AU;SAFA;FA;;;WD)
NewSd: S:NO_ACCESS_CONTROL
Process Name: C:\Windows\System32\icacls.exe

Frequently Asked Questions

What does Windows Event ID 4907 mean?

Auditing settings on a non-Active-Directory object were changed.

Does Event ID 4907 always indicate malicious activity?

No. Administrators and software can legitimately change object SACLs.

How should Event ID 4907 be investigated?

Compare OldSd and NewSd, identify removed audit entries and correlate ProcessId with process creation.

Sources