Event ID: 4713Kerberos policy was changed
Kerberos policy was changed. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Changes Made: ('--' means no changes, otherwise each change is shown as: (Parameter Name): (new value) (old value)) %5
This event is generated only on domain controllers.
Since Kerberos settings affect domain security and changes are generally infrequent, it's recommended to always audit this.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Authentication Policy Change"
LEFT/RIGHT arrow keys for navigationBack to List