4910 The group policy settings for the TBS were changed
A defined but never-generated event. It is meant for changes to the group policy settings of the TBS (TPM Base Services), but the OS does not invoke it.
Overview
The subcategory is Audit Other Policy Change Events. It is meant for the case where the TBS (TPM Base Services) group policy settings change, but as the original docs state, it is not generated. It is the counterpart to the local version 4909.
How it is triggered
- By definition, on a TBS group policy change, but in practice it does not occur.
Security review points
- There is no need to make it a detection target.
Notes for log review
- It is effectively never recorded. Being aware it exists is enough.
Key fields
No specific fields carry practical meaning (since it is not generated).