Windows Event 4719 — System Audit Policy Changed

What This Means

Monitor Windows Event 4719, generated when the system audit policy is modified. Detect defense evasion where attackers disable logging to cover their tracks in your environment.

Example Log

System audit policy was changed.

Subject:
  Security ID:    S-1-5-18
  Account Name:   SYSTEM
  Account Domain: NT AUTHORITY
  Logon ID:       0x3E7

Audit Policy Change:
  Category:       Logon/Logoff
  Subcategory:    Logon
  Subcategory GUID: {0cce9215-69ae-11d9-bed3-505054503030}
  Changes:        Success removed, Failure removed

Indicators of Suspicious Activity

• Audit policies being weakened (Success removed or Failure removed)
• Changes to Logon/Logoff auditing or Object Access auditing
• Policy changes performed by non-SYSTEM accounts or from unexpected systems
• Audit policy changes outside of scheduled Group Policy refresh cycles
• Multiple subcategories being disabled in rapid succession
• Policy changes coinciding with other suspicious events (4625, 4688, 1102)

How to Investigate

1. Identify who or what changed the audit policy (Subject field)
2. Determine which audit subcategories were modified and in what direction
3. Check if the change was part of a legitimate Group Policy update
4. Correlate timing with other suspicious events on the same system
5. Verify the current effective audit policy using auditpol /get /category:*
6. Review Group Policy Object (GPO) version history for unauthorized changes

Recommended Mitigations

• Lock down audit policy configuration using GPO and prevent local overrides
• Alert immediately on any Event 4719 where auditing is weakened
• Monitor for auditpol.exe execution via Event 4688
• Ensure domain controllers enforce audit policy via GPO (not local policy)
• Implement GPO backup and change tracking
• Forward Event 4719 to SIEM with high-priority alerting rules

Related Log Types

Related Attack Patterns

Frequently Asked Questions