Looks like Windows 10 has introduced some new Security event ID's as well as modified the content on some existing messages with more info (4688).
This page seems to have the best breakdown of the new and modified events
In short these are the new ones:
4798/4799 - write operations only used to be audited, now read and query are audited along with write.
4826 - Boot Configuration Database
6416 - PNP events (this one might be interesting to watch around high value assets like DC's)
There are a number of modified events that now have more information in them.
Great resource from Windows IT Pro that summarizes the changes well.
As always, feedback is welcome.
Are you aware of these new EventID's ?
Are you leveraging them in any alerts or reports ?
1 Comment
