4878: Certificate Services restore started
On this page
self explanatory To find out when the restore ended look later in the log for 4879. This event event is only logged if "Backup and restore the CA database" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol
Supercharger's built-in Xpath filters leave the noise behind.
Free.
Certificate Services restore started.
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection
Go To Event ID:
Security Log Quick Reference Chart Download now!