Auditing settings on object were changed

// EVENT DEFINITION:

A System Access Control List (SACL) on an object (`File`, `Registry`, `Service`) was modified.

// DETAILED TELEMETRY & CONTEXT:

Event ID 4817 logs when SACL audit policies are changed or stripped from secured objects. Threat actors sometimes strip SACLs from critical registry keys or files so their subsequent modifications generate no `4657` (`Registry modified`) or `4663` (`File accessed`) telemetry (`Audit Blinding`).

[ ! ]Failure Reason / Root Cause Analysis

Modification of SACL security descriptor on `ObjectName`.

Operational Metadata & Applicability

Log Category:Policy Change

Audit Type Classification:Success Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

4817auditing settings changedsacl modifiedaudit blindingsecurity descriptor altered

MITRE ATT&CK Framework Alignment

T1562.001

Impair Defenses: Disable or Modify ToolsTactic: Defense Evasion

Mitigation Playbook & Recommended SOC Actions

•Inspect `ObjectName` and check if SACLs were removed from critical logging, security, or registry run paths.

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4817</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.336Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to Auditing settings on object were changed -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)