Windows Security Log Event ID 4882

4882: The security permissions for Certificate Services changed

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event documents a change to the access control list of the Certification Authority itself.  The ACL governs who can perform CA level operations documented below.

You can reach the ACL by opening the Properties dialog of the CA in the Certification Authority MMC snap-in.

This event event is only logged if "Change CA security settings" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role...

Roles	Permission	Description
CA Administrator	Manage CA permission	Configure and maintain the CA.
Certificate Manager	Issue and Manage Certificates permission	Approve certificate and revocation requests
	Enroll (aka Request Certificates)	authorized to request certificates
	Read	Read records from the CA database

 

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

Centrally manage WEC subscriptions.

Free.

 

Mini-Seminars Covering Event ID 4882 27 Most Important Windows Security Events

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy