Windows 10: how to enable specific event id in security.evtx

How to enable an Event ID which is not enabled by default in Security.evtx

:)

 

Windows 10 workstation Security log filling with Event ID 4703

My Windows 10 workstation's Security Event Log is filled with informational Event ID 4703 (like 20/second).

It's an Audit Success on Authorization Policy Change category.

Pretty much all are about the javaw.exe process & SeSecurityPrivilege. But also a few of them list svchost.exe as the process & a whole list of privileges.

I can't find anything on the Net about event 4703.

Sometimes it lists the privilege as Disabled (as below), and some are Enabled. Back & forth, multiple events per second.

Does anyone have any idea what/why this is, or anyone else experiencing it?

Here are the details of the event (edited for privacy)...

Task Category: Authorization Policy Change

Level: Information

Keywords: Audit Success

User: N/A

Computer: xxxxx.yyyy.com

Description:

A user right was adjusted.

Subject:

Security ID: SYSTEM

Account Name: XXXXXX

Account Domain: YYYYYYYY

Logon ID: 0x3E7

Target Account:

Security ID: SYSTEM

Account Name: XXXXXXX

Account Domain: YYYYYYYYY

Logon ID: 0x3E7

Process Information:

Process ID: 0xb24

Process Name: C:\Windows\SysWOW64\ContegoSPOP\jre1.7.0_65\bin\javaw.exe

Enabled Privileges:

-

Disabled Privileges:

SeSecurityPrivilege

 

Event id 10016 runtime broker

This ClassID and AppID are for the RuntimeBroker which is used to manage Windows Store apps; specifically monitoring access to APIs and security checks. So ignoring this isn't necessarily the best thing to do.

I had another DCOM error related to the NVidia video card which was killing applications. That ClassID/AppID combination was used in the example to fix the issue here: Event ID 10016 - DistributedCOM

To fix this specific problem. Follow the same steps with one exception: instead of looking for the AppID in DCOM list, look for the application name (RuntimeBroker) directly, since it is there.