4695(S, F): Unprotection of auditable protected data was attempted.
- Windows 10
- Windows Server 2016
There is no example of this event in this document.
Subcategory: Audit DPAPI Activity
Unprotection of auditable protected data was attempted.
Protected Data Flags:%7
Required Server Roles: None.
Minimum OS Version: Windows Server 2008, Windows Vista.
Event Versions: 0.
Security Monitoring Recommendations
There is no recommendation for this event in this document.
This event is typically an informational event and it is difficult to detect any malicious activity using this event. It’s mainly used for DPAPI troubleshooting.