Security

Event ID 4719: Audit policy changed

System audit policy was changedSecurity event 4719 logs a change to the system audit policy, such as Success or Failure auditing being removed for a subcategory with auditpol.

4719

Event ID: 4719
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Log file: Security.evtx
Category: Log integrity
Default logging: Logged by default

What event 4719 means

Event 4719 is written when the local audit policy changes for a subcategory: Success or Failure auditing added or removed. The fields identify the category, the subcategory (by name and GUID) and what changed.

Disabling auditing is a classic defense-evasion step: an attacker who turns off Logon, Process Creation or Object Access auditing before acting removes the very events an investigation would rely on. auditpol /clear, auditpol /set ... /success:disable and scripted policy changes all show up here.

Group Policy also re-applies audit policy regularly, so many records have the computer account or SYSTEM as subject. Focus on changes that remove auditing and on changes made by user accounts.

When it is logged

Audit policy / configuration

Advanced Audit Policy Configuration > Policy Change > Audit Audit Policy Change (Success). Enabled for Success in the default Windows audit policy.

Changes applied through Group Policy can produce a batch of 4719 records at policy refresh. If the Audit Policy Change subcategory itself is disabled, later changes are not logged.

Key fields

Field	What it tells you
SubjectUserName	Account that changed the policy; the computer account for Group Policy.
SubjectLogonId	Logon session; `0x3e7` for SYSTEM, otherwise pivot to 4624 and 4688.
CategoryId	Audit category of the changed subcategory (e.g. Logon/Logoff, Detailed Tracking), as a message code.
SubcategoryId	Subcategory that changed, as a message code rendered to its name (e.g. Logon, Process Creation).
SubcategoryGuid	GUID of the subcategory; stable across languages.
AuditPolicyChanges	What changed, rendered as "Success removed", "Failure removed", "Success added" or "Failure added", or a comma-separated combination.

Common benign sources

Group Policy refresh applying a new or updated advanced audit policy.
Administrators or deployment scripts configuring auditing with auditpol during build or hardening.
Security agents that set the audit policy they depend on.

What attackers do that produces it

auditpol /clear or auditpol /set /category:* /success:disable /failure:disable to blind the Security log.
Removing auditing for specific subcategories (Process Creation, Logon, Object Access) before lateral movement or data access.

Investigation tips

Filter for "removed" changes and for subjects that are user accounts rather than the computer account.
Pivot SubjectLogonId to 4688 to find auditpol.exe or the script that made the change.
Check for 1102 (log cleared) or gaps in the log around the change, and confirm the current policy with auditpol /get /category:*.

MITRE ATT&CK techniques

Technique	Tactics
T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log	Defense Impairment

MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.

Sigma rules for this event

2 SigmaHQ detection rules (release r2026-07-01) target this event.

High · 1
Low · 1

HighImportant Windows Event Auditing DisabledRule by Nasreddine Bencherchali (Nextron Systems), SigmaHQ, DRL 1.1
LowWindows Event Auditing DisabledRule by @neu5ron, Nasreddine Bencherchali (Nextron Systems), SigmaHQ, DRL 1.1

Rules by their named authors, published by SigmaHQ under the Detection Rule License (DRL) 1.1.

Run these rules on your logs

Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.

Open the viewer Filter a log on event 4719

In-depth guideEvent ID 4719: audit policy tampering as an early warning