Event ID 4719: System audit policy was changed
Written when the audit policy changes, for example when auditing of a category is turned off.
- Log
- Security
- Category
- Defense evasion
Why it matters
- Turning off auditing before acting is a known evasion step, and it may explain gaps in your logs.
What to check
Check which category and subcategory changed and who changed it.
How to turn it on
Advanced Audit Policy: Policy Change > Audit Audit Policy Change.
MITRE ATT&CK
- T1562.002 Disable Windows Event Logging