Windows Event ID 4714: Encrypted data recovery policy was changed
Windows Security Event ID 4714 records that the Encrypting File System data recovery agent policy changed.
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
The event is generated when an EFS Data Recovery Agent certificate or policy changes for the computer or device, including during Group Policy update.
Key Fields
EFS policy registry value
Microsoft states the event is generated in the background when HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob changes during Group Policy update.
Computer
The system receiving the EFS recovery-policy change. Prioritize servers storing sensitive encrypted files.
TimeCreated
The time of policy application. Use it to locate the GPO update or certificate change that introduced the recovery policy.
Common False Positives
- Planned EFS recovery-agent certificate rotation or Group Policy maintenance can generate this event.
- Baseline application on newly built hosts can apply the same recovery policy repeatedly.
Related Events
MITRE ATT&CK Mapping
- T1484.001Domain or Tenant Policy Modification: Group Policy Modification
Detection Notes
Treat unexpected 4714 as T1484.001 when it coincides with an unapproved change to HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob, the Microsoft-documented registry value behind EFS recovery policy application. An attacker-controlled recovery agent can make future EFS-protected file recovery possible through policy rather than file-by-file access. Correlate with 4657 on the same HKLM path, GPO change records, and 6145 errors that may indicate policy processing anomalies.
SecurityEvent
| where EventID == 4714
| project TimeGenerated, Computer, EventDataindex=wineventlog EventCode=4714
| table _time, host, MessageEncrypted data recovery policy was changed.
Computer: FILE01
Registry value: HKLM\Software\Policies\Microsoft\SystemCertificates\EFS\EfsBlob