Event ID 4899 — A Certificate Services template was updated.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Collection Priority: Recommended (NSA, others)
Opcode: Info

Description

A Certificate Services template was updated.

Message #

A Certificate Services template was updated.

%1 v%2 (Schema V%3)
%4
%5

Template Change Information:
	Old Template Content: %8
	New Template Content: %7

Additional Information:
	Domain Controller: %6

Fields #

Name	Description
`Domain_Controller`	—
`New_Template_Content`	—
`Old_Template_Content`	—
`TemplateInternalName` UnicodeString	—
`TemplateVersion` UnicodeString	v
`TemplateSchemaVersion` UnicodeString	(Schema V
`TemplateOID` UnicodeString	—
`TemplateDSObjectFQDN` UnicodeString	—
`DCDNSName` UnicodeString	[Additional Information] Domain Controller
`NewTemplateContent` UnicodeString	[Template Change Information] New Template Content
`OldTemplateContent` UnicodeString	[Template Change Information] Old Template Content

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

ADCS Certificate Template Configuration Vulnerability source low: Detects certificate creation with template allowing risk permission subject↳ also matches:Event ID 4898: Certificate Services loaded a template.
ADCS Certificate Template Configuration Vulnerability with Risky EKU source high: Detects certificate creation with template allowing risk permission subject and risky EKU↳ also matches:Event ID 4898: Certificate Services loaded a template.

References #

Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4899
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4899

Event ID 4899 — A Certificate Services template was updated.

Description

Message #

Fields #

Detection Rules #

Sigma # view in reference

Related Events #

References #