Event ID 4694
Protection of auditable protected data was attemptedProtection of auditable protected data was attempted. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Protected Data: Data Description: %6 Key Identifier: %5 Protected Data Flags: %7 Protection Algorithms: %8 Status Information: Status Code: %9
This event generates if DPAPI CryptProtectData function was used with CRYPTPROTECT_AUDIT flag enabled.
Auditing:
Always
Generally only necessary for troubleshooting purposes, but due the low volume is nevertheless recommended.
Volume:
Low
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"DPAPI Activity"
LEFT/RIGHT arrow keys for navigation
Back to List