Submit a ticketCall us

WebinarUpcoming Webinar: Know What’s Changed – with NEW Server Configuration Monitor

Change management in IT is critical. But, even with a good change management process, changes are too often not correctly tracked, if at all. The configuration of your servers and applications is a key factor in their performance, availability, and security. Many incidents can be tracked back to an authorized (and sometimes unauthorized) configuration change, whether to a system file, configuration file, or Windows® Registry entry. Join SolarWinds VP of product management Brandon Shopp to discover how the new SolarWinds® Server Configuration Monitor is designed to help you.

Register now.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Windows 10 Security Event Log populated with ID 4703 events

Windows 10 Security Event Log populated with ID 4703 events

Table of contents

 

Overview

Windows 10 can generate Policy Change auditing events with ID 4703. These events are generated when your audit policy settings are set to SUCCESS and the requested action succeeds. 

Policy Change auditing is usually set to to audit FAIL events. When you change this setting to SUCCESS, you may receive multiple events in your security log. These events may not be critical security events, which can require an extensive amount of time to troubleshoot and resolve. 

Environment

  • Workstations running Windows 10

Detail

LEM 6.3 will not normalize ID 4703 events related to your LEM agent. You can disable the SUCCESS auditing policy in the group policy console located at:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

 

 

 

Last modified

Tags

Classifications

Public