SOC Event Lookup
Event ID 4715PolicyP2

Windows Event ID 4715: The audit policy (SACL) on an object was changed

Windows Security Event ID 4715 records a change to the local audit policy security descriptor.

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-13

Trigger Scenarios

This event is generated every time the local audit policy security descriptor changes and is logged regardless of the Audit Policy Change subcategory setting.

Key Fields

OldSd / NewSd

The original and new Security Descriptor Definition Language strings for the audit policy. Removing SACL entries such as AU with SA or FA can reduce success or failure auditing.

SubjectUserName / SubjectLogonId

Identifies the account and hexadecimal logon session that changed the audit policy security descriptor.

SDDL rights and flags

Microsoft documents SDDL elements including S: for SACL, SA for successful access audit, FA for failed access audit, WD for Modify Permissions, WO for Modify Owner, and hex rights such as 0xf0007.

Common False Positives

  • Approved audit delegation changes can legitimately change OldSd and NewSd.
  • Security baseline deployment tools may reset the descriptor during controlled hardening windows.

Related Events

MITRE ATT&CK Mapping

  • T1562.002Impair Defenses: Disable Windows Event Logging

Detection Notes

Use threshold=1 unplanned 4715 on high-value systems: Microsoft documents that this event is always logged when the local audit policy security descriptor changes. Compare OldSd and NewSd for removal of S: SACL entries, SA/FA audit flags, or rights such as WD/WO/0xf0007 assigned to unexpected trustees; removing those values impairs evidence collection and maps to T1562.002 Disable Windows Event Logging. Correlate SubjectLogonId with 4624 and any 4719 audit policy change before suppressing.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4715
| project TimeGenerated, Computer, Account
Splunk SPL
index=wineventlog EventCode=4715 | table _time, host
Sample Log
EventID: 4715
SubjectUserName: dadmin
SubjectLogonId: 0x11ae30
OldSd: D:(A;;DCSWRPDTRC;;;BA)S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
NewSd: D:(A;;DCSWRPDTRC;;;BA)S:NO_ACCESS_CONTROL

Source

Official documentationMachine-readable JSON