ZEKASTRA

SecurityAudit policy and log integrity

4719 · System audit policy was changed

Generated when the computer's audit policy changes. Records the category, subcategory and whether success or failure auditing was added or removed.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • CategoryId
  • SubcategoryId
  • SubcategoryGuid
  • AuditPolicyChanges

02How to use it

A removed audit setting explains gaps in later logs; establish when the change happened and whether it was planned (for example Group Policy refresh) or followed suspicious activity.

03Caveats

Microsoft states the event is always logged regardless of the Audit Policy Change setting. It shows that the policy changed, not why; check Group Policy history before attributing the change to a person.

05Sources

  1. Microsoft Learn — 4719(S) System audit policy was changed checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.