Event ID: 4905

An attempt was made to unregister a security event source 

An attempt was made to unregister a security event source.

Subject
    Security ID:    %1
    Account Name:   %2
    Account Domain: %3
    Logon ID:       %4

Process:
    Process ID:   %7
    Process Name: %8

Event Source:
    Source Name:     %5
    Event Source ID: %6
Microsoft Documentation

Event ID - 4905



This event generates every time a security event source is unregistered.

You typically see this event if specific roles were removed, for example, Internet Information Services.



Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any S-1-5-18
Account Name SubjectUserName %2 Any DC01$
Account Domain SubjectDomainName %3 Any DOMAIN
Logon ID SubjectLogonId %4 Any 0x3e7
Source Name AuditSourceName %5 Any IIS-METABASE
Event Source ID EventSourceId %6 Any 0x20c15f
Process ID ProcessId %7 Any 0xd90
Process Name ProcessName %8 Any -

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"
How to enable Windows Auditing

Operating Systems:
Windows Vista Windows 2008 Windows 7 Windows 2008 R2 Windows 8 Windows 2012 Windows 8.1 Windows 2012 R2 Windows 10 Windows 2016 Windows 2019

Audit Category:
Policy Change

Audit Subcategory:
Audit Policy Change
Legacy Events:
809

LEFT/RIGHT arrow keys for navigation

Back to List