Windows Security Log Event ID 4934

4934: Attributes of an Active Directory object were replicated

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.  

Directory Service replication has little to no security relevance.  I recommend disabling these 2 subcategories: 

• Directory Service Replication
• Detailed Directory Service Replication

Since DCSync and DCShadow have come out I've changed my mind about the above statement.  Check out this webinar AD Attack Deep Dive: Gaining Persistence using DCSync and DCShadow with Mimikatz

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

 

 

Upcoming Webinars Breakdown of a Phishing Attack: Dissecting the Uber and MailChimp Data Breaches Before and After the Inbox

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy