Windows Security Log Event ID 4882

4882: The security permissions for Certificate Services changed

On this page

• Description of this event
• Field level details
• Examples

This event documents a change to the access control list of the Certification Authority itself.  The ACL governs who can perform CA level operations documented below.

You can reach the ACL by opening the Properties dialog of the CA in the Certification Authority MMC snap-in.

This event event is only logged if "Change CA security settings" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role... Allow user/group

  permission/role

  permission/role

  permission/role...

Roles	Permission	Description
CA Administrator	Manage CA permission	Configure and maintain the CA.
Certificate Manager	Issue and Manage Certificates permission	Approve certificate and revocation requests
	Enroll (aka Request Certificates)	authorized to request certificates
	Read	Read records from the CA database

 

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 4882 27 Most Important Windows Security Events

 

Upcoming Webinars Securing Every Identity in the Hybrid Era: Building a Unified Strategy Across Cloud, On-Prem, and AI “3 Persistent Privileged Access Methods in Active Directory: How Attackers Stick the Landing with AdminSdHolder, SIDHistory, DCShadow”

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy