Every 5 minutes a bunch of events 4719 System audit policy was changed occurr

Question

Every 5 minutes a bunch of events 4719 System audit policy was changed occurr

Christina (Tina) Gillgren 25

We have Windows server 2022 domain controllers and every 5 minutes a bunch of events 4719 System audit policy was changed occurr. This started happening Tuesday early am. I checked logs thoroughly and see no indication of anything out of the ordinary. I can also run the auditpol /get /category:* and see that my auditing is still enabled. I checked the Def dom controller policy and no changes were made. I checked the Def Domain polic and no change.

I do not have a clear understanding of how to solve this issue as the only thing that changed was a MS security update was applied to two of the DC's the day before. I have tried uninstalling the MS sec update and rebooting but no change. Has anyone run across this before???

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

This behavior is not malicious; it’s a side effect of recent Microsoft security updates on Windows Server 2022 domain controllers. The 4719 events are being logged every Group Policy refresh cycle (~5 minutes on DCs) because the update changed how audit policy refreshes are reported, even if no effective audit settings are altered.

What you’re seeing is essentially a reporting inconsistency introduced by the patch. Event ID 4719 (“System audit policy was changed”) is normally triggered when audit categories are modified. In your case, the auditpol output confirms that your baseline auditing remains intact, and your domain policies haven’t been altered. The repeated 4719 entries are being generated because the DCs are reapplying audit policy during each refresh, and the patched build now logs this as a change event even when the effective configuration is identical. Microsoft has acknowledged similar issues in past cumulative updates, where audit policy reporting was noisy but did not indicate a real security gap.

To validate, check the event details: if the SubjectUserName is SYSTEM and the changes correspond to Group Policy refresh, this is benign. Suspicious cases would show Success/Failure auditing being removed by a non-administrative account, which is not what you’re seeing.

The recommended action is to ensure your DCs are fully patched with the latest cumulative update for Windows Server 2022, as Microsoft typically corrects these reporting anomalies in subsequent releases. Do not attempt to suppress the events via auditpol or registry edits, as that would weaken your audit trail. Instead, treat them as informational noise until Microsoft issues a servicing fix. If you want to reduce log clutter, you can filter 4719 events where SubjectUserName = SYSTEM in your SIEM or event forwarding rules, but keep monitoring for any 4719 entries tied to interactive accounts, as those would be genuine red flags.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.