Windows Security Log Event ID 4817

4817: Auditing settings on object were changed.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Auditing settings on object were changed.

This event is new to Windows 2008 Release 2 and Windows 7. It does not appear in earlier versions of Windows.

We have not been able to produce this event.

This event has the same title as Event 4907 although the fields are somewhat different.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4817

Subject:
 Security ID:  %1
 Account Name:  %2
 Account Domain:  %3
 Logon ID:  %4

Object:
 Object Server: %5
 Object Type: %6
 Object Name: %7

Auditing Settings:
 Original Security Descriptor: %8
 New Security Descriptor:  %9

Supercharger Free Edition

Centrally manage WEC subscriptions.

Free.

 

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy