Event ID 4713
Kerberos policy was changedKerberos policy was changed.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Changes Made:
('--' means no changes, otherwise each change is shown as:
(Parameter Name): (new value) (old value))
%5This event is generated only on domain controllers.
Auditing: Always
Since Kerberos settings affect domain security and changes are generally infrequent, it's recommended to always audit this.
Volume: Low
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Authentication Policy Change" LEFT/RIGHT arrow keys for navigation
Back to List