Event ID 4694

Protection of auditable protected data was attempted

Protection of auditable protected data was attempted.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Protected Data:
    Data Description:       %6
    Key Identifier:         %5
    Protected Data Flags:   %7
    Protection Algorithms:  %8

Status Information:
    Status Code:            %9


This event generates if DPAPI  CryptProtectData function was used with CRYPTPROTECT_AUDIT flag enabled.

Auditing:     Always

Generally only necessary for troubleshooting purposes, but due the low volume is nevertheless recommended.


Volume:     Low


Microsoft Documentation

Event ID - 4694



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"DPAPI Activity"



LEFT/RIGHT arrow keys for navigation

Back to List