win:security 5467
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Policy Change > Audit Filtering Platform Policy Change
- Audit category
- Policy Change
- Audit subcategory
- Audit Filtering Platform Policy Change
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Listed | |
| Windows member server | Listed | |
| Windows domain controller | Listed | |
| Windows web server (IIS), internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. |