Windows Security Log Event ID 4692

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Process Tracking
 • DPAPI Activity
Type Success
Corresponding events
in Windows 2003
and before
596  
Discussions on Event ID 4692
Ask a question about this event

4692: Backup of data protection master key was attempted

On this page

Microsoft documentation indicates this is a routine event that can be filtered out of events to review.  At this time I classify this as a "noise" event.

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

Description Fields in 4692

Subject:

  •    Security ID:  %1
  •    Account Name:  %2
  •    Account Domain:  %3
  •    Logon ID:  %4

Key Information:

  •    Key Identifier: %5
  •    Recovery Server: %6
  •    Recovery Key ID: %7

Status Information:

  •    Status Code: %8

Supercharger Free Edition


Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

Examples of 4692

Backup of data protection master key was attempted.

Subject:

   Security ID:  %1
   Account Name:  %2
   Account Domain:  %3
   Logon ID:  %4

Key Information:

   Key Identifier: %5
   Recovery Server: %6
   Recovery Key ID: %7

Status Information:

   Status Code: %8

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources