Event ID 4657

A registry value was modified

A registry value was modified.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Object:
    Object Name:        %5
    Object Value Name:  %6
    Handle ID:          %7
    Operation Type:     %8

Process Information:
    Process ID:         %13
    Process Name:       %14

Change Information:
    Old Value Type:     %9
    Old Value:          %10
    New Value Type:     %11
    New Value:          %12


This event only logs changes to registry values, to see when a registry key is added or deleted, refer to event 4663.

Microsoft Documentation

Event ID - 4657



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any THEDOMAIN\TheUser
Account NameSubjectUserName%2Any TheUser
Account DomainSubjectDomainName%3Any THEDOMAIN
Logon IDSubjectLogonId%4Any 0x364ef
Object NameObjectName%5Any \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Object Value NameObjectValueName%6Any New_Name
Handle IDHandleId%7Any 0x54
Operation TypeOperationType%8Any Existing registry value modified
Old Value TypeOldValueType%9Any REG_SZ
Old ValueOldValue%10Any
New Value TypeNewValueType%11Any REG_SZ
New ValueNewValue%12Any Andreas
Process IDProcessId%13Any 0xec43
Process NameProcessName%14Any C:\Windows\regedit.exe


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:Registry



LEFT/RIGHT arrow keys for navigation

Back to List