4909 The local policy settings for the TBS were changed
A defined but never-generated event. It is meant for changes to the local policy settings of the TBS (TPM Base Services), but the OS does not invoke it.
Overview
The subcategory is Audit Other Policy Change Events. It is meant for the case where the TBS (TPM Base Services: the base service for working with the TPM chip) local policy settings change, but as the original docs state, it is not generated.
How it is triggered
- By definition, on a TBS local policy change, but in practice it does not occur.
Security review points
- There is no need to make it a detection target.
Notes for log review
- It is effectively never recorded. Being aware it exists is enough.
Key fields
No specific fields carry practical meaning (since it is not generated).