Security Compliance
Windows 10 security event log populated with ID 4703 events in SEM
This article addresses ID 4703 that may appear in your Microsoft Windows 10 security event log.
First published date
Last published date
Overview
This article applies to Security Event Manager (formerly Log & Event Manager).
Windows 10 can generate policy change auditing events with ID 4703. These events are generated when your audit policy settings are set to Success and the requested action succeeds.
Policy change auditing is usually set to to audit Fail events. When you change this setting to Success, you may receive multiple events in your security log. These events may not be critical security events (which can require an extensive amount of time to troubleshoot and resolve).
Product section
Resolution
SEM will not normalize ID 4703 events related to your SEM agent. You can disable the Success auditing policy in the group policy console located at:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy