Windows Security Log Event ID 4692
| Operating Systems |
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
|
Category
• Subcategory | Process Tracking
• DPAPI Activity |
|
Type
|
Success
|
Corresponding events
in Windows
2003
and before |
596
|
4692: Backup of data protection master key was attempted
On this page
Microsoft documentation indicates this is a routine event that can be filtered out of events to review. At this time I classify this as a "noise" event.
I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.
Free Security Log Resources by Randy
Subject:
- Security ID: %1
- Account Name: %2
- Account Domain: %3
- Logon ID: %4
Key Information:
- Key Identifier: %5
- Recovery Server: %6
- Recovery Key ID: %7
Status Information:
Supercharger Free Edition