win:security 4985
The state of a transaction has changed.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit File System
- Audit category
- Object Access
- Audit subcategory
- Audit File System
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
DISA STIG (server); DISA STIG (workstation)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | DISA STIG (workstation) |
| Windows member server | Recommended | DISA STIG (server) |
| Windows domain controller | Recommended | DISA STIG (server) |
| Windows web server (IIS), internet-facing | Recommended | DISA STIG (server) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000110 (workstation): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000115 (workstation): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000587 (workstation): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000588 (workstation): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000300 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000310 (server): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000587 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000588 (server): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000110 (workstation): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000115 (workstation): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000581 (workstation): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000582 (workstation): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000587 (workstation): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000588 (workstation): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000300 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000310 (server): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000587 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000588 (server): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000300 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000310 (server): Audit Sensitive Privilege Use Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000587 (server): Audit Sensitive Privilege Use Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000588 (server): Audit Sensitive Privilege Use Failure |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: The state of a transaction has changed. |