Event ID: 4905

An attempt was made to unregister a security event source

An attempt was made to unregister a security event source.

    Security ID:    %1
    Account Name:   %2
    Account Domain: %3
    Logon ID:       %4

    Process ID:   %7
    Process Name: %8

Event Source:
    Source Name:     %5
    Event Source ID: %6

This event generates every time a security event source is unregistered.

You typically see this event if specific roles were removed, for example, Internet Information Services.

Microsoft Documentation

Event ID - 4905

Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any S-1-5-18
Account Name SubjectUserName %2 Any DC01$
Account Domain SubjectDomainName %3 Any DOMAIN
Logon ID SubjectLogonId %4 Any 0x3e7
Source Name AuditSourceName %5 Any IIS-METABASE
Event Source ID EventSourceId %6 Any 0x20c15f
Process ID ProcessId %7 Any 0xd90
Process Name ProcessName %8 Any -

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"

LEFT/RIGHT arrow keys for navigation

Back to List