Zurück
-
Titel
Multiple Event ID 4703 being logged in Security Event Log -
Beschreibung
The Windows Security event log is filling with Event ID 4703 on servers running the Change Auditor agent. The Change Auditor agent, NPSrvHost.exe, is the Process name. -
Ursache
Microsoft captures Successes and Failures of EventID 4073 "A user right token has been adjusted" and is turned on by default in the Local Auditing Policy. -
Lösung
Either ignore the event or disable the Success Auditing of that event in the Local Auditing Policy:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy
-
Fehler-ID
VSTS226515 -
Weitere Informationen
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703