Windows Security Log Event ID 4887

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Object Access
 • Certification Services
Type Success
Corresponding events
in Windows 2003
and before

4887: Certificate Services approved a certificate request and issued a certificate

On this page

This event is logged when a certificate is issued as a result of either:

    • An administrator or certificate manager issues a pending request
    • The CA automatically approves the request based on the CA's policy and that of the certificate template associated with the request.

To find out more about the request look for other events with the same Request ID.

This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Request ID: The certificate request is identified by the Request ID.  To get the details on the request including who requested it you will need to look in the log for other events with the same Request ID.

Requester: the account that requested the certificate
Attributes:  unknown.  if you have information to share on this event please start a discussion.

Attributes: attributes taken from the certificate template and request

UserAgent: the browser ID or other program that submitted the request

ccm: apparently <ca computer name>.<domain name>

Free Security Log Resources by Randy

Description Fields in 4887

  • Disposition:

0 CR_DISP_INCOMPLETE request did not complete
1 CR_DISP_ERROR failed
4 CR_DISP_ISSUED_OUT_OF_BAND issued separately
5 CR_DISP_UNDER_SUBMISSION taken under submission

  • SKI: subject key identifier
  • Subject: the distinguished name of the subject of the certificate

Supercharger Enterprise

Load Balancing for Windows Event Collection


Examples of 4887

Certificate Services approved a certificate request and issued a certificate.

Request ID: 4
Requester: ACME-FR\Administrator
UserAgent:Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727)

Disposition: 3
SKI:  f4 86 30 6c 7b ed 5d fd 06 c9 60 20 68 fd 62 20 18 7a 0d c3
Subject: CN=Administrator, CN=Users, DC=acme-fr, DC=local

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources