Windows Security Log Event ID 4891

4891: A configuration entry changed in Certificate Services

On this page

• Description of this event
• Field level details
• Examples

Windows logs this event to document changes to Certificate Services registry entries many of which correspond to properties in the CA Properties dialog of Certification Authority MMC snap-in.

You can learn more about the various entries at http://technet2.microsoft.com/windowsserver/en/library/7fe116af-971b-44d3-809e-00606c080a191033.mspx?mfr=true

Node: the subkey path under HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\ca name

Entry: The registry value name

Value: the data of the value

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4891

• Node: %1
• Entry: %2
• Value: %3

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 4891 27 Most Important Windows Security Events

 

Upcoming Webinars

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy