5070 A cryptographic function property modification was attempted
Written when a modification of a cryptographic function property is attempted. It is one of a family of events capturing CNG configuration changes.
Overview
The subcategory is Audit Other Policy Change Events. It is generated when a modification of a CNG cryptographic function property is attempted. Whereas 5069 is the operation version, this indicates a modification. It is the last of the CNG configuration audit family (5063 to 5070).
How it is triggered
- A settings change to a cryptographic function property.
Security review points
- It is a configuration-change event with low individual security value. If you suspect tampering with the crypto configuration, confirm it together with the family (5063 to 5069).
Notes for log review
- Monitor crypto-configuration events as a group and note unfamiliar changes.
Key fields
| Field | Meaning |
|---|---|
Operation | The modification type |
Subject | The acting subject |