Home > Success Center > Log & Event Manager (LEM) > Windows 10 hosts continuously send Event ID 4703 to LEM

Windows 10 hosts continuously send Event ID 4703 to LEM

Created by Geoffrey Layton, last modified by Jason Dee on Feb 02, 2017

Views: 1,549 Votes: 2 Revisions: 9

Overview

The LEM console is being flooded by Event ID 4703 events being sent from Windows 10 agents.

Environment

  • All LEM versions
  • Windows 10 hosts

Cause

This is a new, relentless event type being sent from Windows 10-based hosts.

Resolution

You can prevent the events from being generated on the hosts themselves by disabling a specific subcategory in its audit policy.

 

Change the Authorization Policy Change subcategory to No Auditing either through the local policy or a group policy. See Audit policies and best practices for more information on adjusting audit policies.

You must to post a comment.
Last modified
21:40, 2 Feb 2017

Tags

Classifications

Public