ZEKASTRA

SecurityProcess and object access

4657 · A registry value was modified

Generated when a registry value is created, modified or deleted under an audited key. Records the old and new value and type.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • ObjectName
  • ObjectValueName
  • HandleId
  • OperationType
  • OldValueType
  • OldValue
  • NewValueType
  • NewValue
  • ProcessId
  • ProcessName

02How to use it

Shows the before and after state of autostart locations and security settings together with the process that changed them. Compare with registry hive analysis, where only the final state and key LastWrite time survive.

03Caveats

Requires Audit Registry and "Set Value" auditing in the key's SACL. Not generated when only a key (not a value) changes. ObjectName uses \REGISTRY\MACHINE style paths.

05Sources

  1. Microsoft Learn — 4657(S) A registry value was modified checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.