SOC Event Lookup
Event ID 4693DPAPIP3

Windows Event ID 4693: Recovery of data protection master key was attempted

Windows Security Event ID 4693 records an attempted recovery of a DPAPI master key.

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-13

Trigger Scenarios

When DPAPI cannot unprotect data with the user password-protected master key, it can send the backup master key to a domain controller for recovery by protected RPC.

Key Fields

MasterKeyId

Unique identifier of the recovered master key. Microsoft documents that the master-key file name is the ID under the user Protect folder.

RecoveryReason

Hex code for the recovery reason. Microsoft examples show RecoveryReason 0x5c005c and note that this field can contain Recovery Server information.

FailureId

Hex status for the operation. Microsoft documents 0x380000 as the typical success value.

Common False Positives

  • Legitimate DPAPI recovery can occur after password reset, domain recovery operations, or troubleshooting.
  • Recovery Server field behavior can be confusing because Microsoft notes it can contain Recovery Reason information in this event.

Related Events

MITRE ATT&CK Mapping

  • T1555Credentials from Password Stores

Detection Notes

Microsoft says 4693 is mainly DPAPI troubleshooting, so escalate T1555 only when the actor and reason are unusual. FailureId 0x380000 is the documented success value and RecoveryReason is a HexInt32; a successful recovery by an unexpected admin or service account means a DPAPI master key was recovered and could unlock secrets protected under %APPDATA%\Roaming\Microsoft\Windows\Protect\%SID%. Correlate MasterKeyId to the user profile path and review 4624, 4692, 5377, and file-access telemetry around the same logon session.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4693
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId, MasterKeyId, RecoveryReason, RecoveryServer, FailureId
Splunk SPL
index=wineventlog EventCode=4693
| table _time, host, SubjectUserName, SubjectLogonId, MasterKeyId, RecoveryReason, RecoveryServer, FailureId
Sample Log
Subject: CORP\dadmin
Logon ID: 0x30d7c
MasterKeyId: 0445c766-75f0-4de7-82ad-d9d97aad59f6
RecoveryReason: 0x5c005c
RecoveryServer: DC01.contoso.local
FailureId: 0x380000

Source

Official documentationMachine-readable JSON