Event ID: 4715

The audit policy (SACL) on an object was changed

The audit policy (SACL) on an object was changed.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Audit Policy Change:
    Original Security Descriptor:   %5
    New Security Descriptor:        %6



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List