Event ID 4826
Boot Configuration Data loaded
Boot Configuration Data loaded.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
General Settings:
Load Options: %5
Advanced Options: %6
Configuration Access Policy: %7
System Event Logging: %8
Kernel Debugging: %9
VSM Launch Type: %10
Signature Settings:
Test Signing: %11
Flight Signing: %12
Disable Integrity Checks: %13
HyperVisor Settings:
HyperVisor Load Options: %14
HyperVisor Launch Type: %15
HyperVisor Debugging: %16
This event generates every time system starts and loads current Boot Configuration Data (BCD) settings.
Auditing:
Always
This event is always logged regardless of the "Audit Other Policy Change Events" sub-category setting.
Volume:
Low
Only logged once during system boot.
| Name |
Field |
Insertion String |
OS |
Example |
|
|
|
Security ID |
SubjectUserSid |
%1 |
Any |
SYSTEM
|
|
|
Account Name |
SubjectUserName |
%2 |
Any |
-
|
|
|
Account Domain |
SubjectDomainName |
%3 |
Any |
-
|
|
|
Logon ID |
SubjectLogonId |
%4 |
Any |
0x3e7
|
|
|
Load Options |
LoadOptions |
%5 |
Any |
-
|
|
|
Advanced Options |
AdvancedOptions |
%6 |
Any |
No
|
|
|
Configuration Access Policy |
ConfigAccessPolicy |
%7 |
Any |
Default
|
|
|
System Event Logging |
RemoteEventLogging |
%8 |
Any |
No
|
|
|
Kernel Debugging |
KernelDebug |
%9 |
Any |
No
|
|
|
VSM Launch Type |
VsmLaunchType |
%10 |
Any |
Off
|
|
|
Test Signing |
TestSigning |
%11 |
Any |
No
|
|
|
Flight Signing |
FlightSigning |
%12 |
Any |
No
|
|
|
Disable Integrity Checks |
DisableIntegrityChecks |
%13 |
Any |
No
|
|
|
HyperVisor Load Options |
HypervisorLoadOptions |
%14 |
Any |
-
|
|
|
HyperVisor Launch Type |
HypervisorLaunchType |
%15 |
Any |
Off
|
|
|
HyperVisor Debugging |
HypervisorDebug |
%16 |
Any |
No
|
This event is typically triggered by the SYSTEM account, which can sometimes appear as "S-1-5-18"
The name of the account that reported this event. The value is always “-“ for this event.
Security ID subject’s domain or computer name. However, the value is always “-“ for this event.
This value is likely always 0x3e7.
Parameters that were set for the boot loader in BCD. Load options are set via bcdedit.exe /set loadoptions.
The advanced options control the legacy menu that is invoked with the F8 key. The value of Yes means that BCD is configured to display the F8 menu and/or that the F8 button was pressed during boot. Advanced options are set via bcdedit /set onetimeadvancedoptions. This value is No by default.
Configured via bcdedit.exe /set configaccesspolicy. Controls whether the system uses memory-mapped I/O or uses the HALs I/O. Possible values are Default and DisallowMmConfig.
Controls whether remote event logging is enabled on this system. This value is configured via bcdedit.exe /event.
Indicates whether kernel debugging is enabled or not, configured via bcdedit.exe /debug.
Indicates whether Virtual Secure Mode (VSM) is enabled on the host. VSM enhances the security of a Windows 10 (or later) host that is part of a domain. Enabling this option requires the Hyper-V role, group policy settings as well as bcdedit.exe /set vsmlaunchtype auto. See http://woshub.com/virtual-secure-mode-vsm-in-windows-10-enterprise/ for more information.
Test Signing controls whether drivers and modules are required to be signed by trusted certificates (and not just any certificate). This field shows whether Windows Test Signing is enabled or not, test signing is not enabled by default and the default value is "No".
This setting is enabled via bcdedit.exe /set testsigning ON.
Indicates whether executables and drivers that are signed internally for Insider Preview builds. Enable this setting via bcdedit.exe /set flightsigning ON to trust Windows Insider Preview builds.
Disabling integrity checks allows for unsigned drivers to be loaded during system boot, which is not recommended for production environments.
You can enable integrity checks using bcdedit.exe /set nointegritychecks off
HyperVisor load options are configured via bcdedit.exe /set hypervisorloadoptions.
HyperVisor launch options can be "Off" or "Auto".
HyperVisor launch type is configured using bcdedit.exe /set hypervisorlaunchtype.
Shows whether the HyperVisor debugger is enabled or not (Yes or No).
Hyper-V debugging can be enabled using bcdedit.exe /set hypervisordebug on
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Other Policy Change Events"
LEFT/RIGHT arrow keys for navigation
Back to List