Eric Partington

Logs - New Windows Security Event ID's

Blog Post created by Eric Partington Employee on Jan 27, 2017

Looks like Windows 10 has introduced some new Security event ID's as well as modified the content on some existing messages with more info (4688).

 

This page seems to have the best breakdown of the new and modified events

https://github.com/Microsoft/windows-itpro-docs/blob/master/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md

 

In short these are the new ones:

 

4798/4799 - write operations only used to be audited, now read and query are audited along with write.

4826 - Boot Configuration Database

6416 - PNP events (this one might be interesting to watch around high value assets like DC's)

 

There are a number of modified events that now have more information in them.

 

Great resource from Windows IT Pro that summarizes the changes well.

 

As always, feedback is welcome. 

 

Are you aware of these new EventID's ?

Are you leveraging them in any alerts or reports ?

Outcomes