Windows Security Log Event ID 4885

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Object Access
 • Certification Services
Type Success
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 4885
Ask a question about this event

4885: The audit filter for Certificate Services changed

On this page

Windows logs this event whenever you modify the Auditing tab of the Properties dialog of the CA in the Certification Authority MMC snap-in.  The Audit tab controls which CA releated events are reported to the security log.

The Filter: field below is a bitwise representation of the check boxes on the Audit tab mentioned above.

Free Security Log Resources by Randy

Description Fields in 4885

Filter:

Selected values

0 - all auditing disabled

127 - all auditing enabled

Bit Meaning
1 Start and stop Active Directory Certificate Services
2 Backup and restore the CA database
3 Issue and manage certificate requests
4 Revoke certificates and publish CRLs
5 Change CA security settings
6 Store and retrieve archived keys
7 Change CA configuration

The order of the check boxes in the Auditing tab dialog do not correspond to the order of the bits in the filter.

The decision to log this event at all is governed by the filter itself, specifically the "Change CA configuration" check box.  Unfortunateley if you disable this box, no event is recorded.

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 4885

The audit filter for Certificate Services changed.

Filter: 126

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources