4716 Trusted Domain info was modified Expand / Collapse
Author
Message
Posted 6/24/2011 11:38:29 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/24/2011 11:01:51 AM
Posts: 1, Visits: 0
How do I know that a change actually occured when everyone claims they didn' change anything?  The message says Anonymous Logon and logon ID = 0x3e6...

This is the second month in a row that my report shows changes on the same date.

Any suggestions?

Post #747
Posted 7/8/2011 11:05:07 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
I would need to see the actual event
Post #757
Posted 7/14/2011 8:25:27 AM
Genius

GeniusGeniusGeniusGeniusGeniusGeniusGeniusGenius

Group: Forum Members
Last Login: 12/22/2011 4:55:21 PM
Posts: 12, Visits: 3
Hi,

This event is generated when DC change password for Trust Relationship, attribute trustAuthInfo.

You can verify which attribute have been modified using adsiedit tool. On system container open properities of trusteddomain object and check this attribute (msDS-ReplAttributeMetaData). You can see with attribute have been modified at event time. If attribute is trustauthinfo then is password change of relationship.

Regards

Post #770
Posted 7/14/2011 9:15:47 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Thanks JavierC!
Post #771
Posted 1/14/2013 10:40:48 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/6/2013 8:54:11 AM
Posts: 4, Visits: 8
Is this of concern? Event 4716

Jan 2 01:48:50 172.28.28.49 MSWinEventLog 3 Security 3758023 Wed: Jan 02 01:48:48 2013 4716 Microsoft-Windows-Security-Auditing NT AUTHORITY\ANONYMOUS LOGON N/A Success Audit xxxxxxxxxxx Authentication Policy Change Trusted domain information was modified. Subject: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: 0x3e6 Trusted Domain: Domain Name: - Domain ID: S-1-5-21-958271350-3216788496-3344630569 New Trust Information: Trust Type: 2 Trust Direction: 3 Trust Attributes: 32 SID Filtering: - 3754350
Post #1161
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 4:11am