Windows Security Log Event ID 4869

4869: Certificate Services received a resubmitted certificate request

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event gets logged more than the description would indicate.  It seems to be logged whenever 

• the Certification Authority receives a certificate request that matches a previous request that was either denied to set to pending
• the administrator or other certificate manager Issues a pending request.  This event 4869 is logged in addition to 4887.

This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

 

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy