Windows Security Log Event ID 4934

4934: Attributes of an Active Directory object were replicated

On this page

• Description of this event
• Field level details
• Examples

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.  

Directory Service replication has little to no security relevance.  I recommend disabling these 2 subcategories: 

• Directory Service Replication
• Detailed Directory Service Replication

Since DCSync and DCShadow have come out I've changed my mind about the above statement.  Check out this webinar AD Attack Deep Dive: Gaining Persistence using DCSync and DCShadow with Mimikatz

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

 

Upcoming Webinars AI Usage by Employees: Understand the Risks and Mitigations Before Choosing What to Do About It Identifying the Tier 0 Assets in Your Active Directory Environment is Step #1 in ITDR

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy