Which Windows Event ID Tracks Registry Value Changes?
Short answer
A Event ID 4657 is logged when a registry value is added or modified, letting Maria confirm the executable's registry changes in Event Viewer.
Question
Key Takeaways
The question tests knowledge of Windows security auditing event IDs, and the trap is confusing registry-change auditing (4657) with process-creation (4688), service-change (7040), or logon (4624) events.
When analyzing a suspicious executable in a controlled Windows environment, analysts can use Event Viewer to detect registry modifications. Event ID 4657 is logged when a registry value (object attribute) is changed, making it the correct choice for confirming that the malware added or modified a registry entry.
Common mistake: Learners often pick Event ID 4688 because executing a suspicious file immediately creates a new process, but 4688 only proves execution — it does not reveal whether any registry value was added or modified.
Expert Analysis
Why the Answer Is Correct
Event ID 4657 is generated when an audited object's attribute is modified, and registry values are treated as object attributes, so a change to a registry value produces this event. The entry includes the object name (registry key path), the attribute (value name), plus the old and new data, which is exactly the evidence Maria needs to prove the executable added or modified a registry value. Because the question explicitly asks about registry value additions/modifications after execution, 4657 is the only option that directly answers it, and the unanimous community vote and Elb's note that "4657 A registry value was modified" both align with this.
Why the Other Options Are Wrong
Event ID 4688 records creation of a new process, which confirms the executable ran but says nothing about registry writes, so it answers a different question. Event ID 7040 indicates a service configuration (start type) changed, which is logged by the service control manager rather than registry auditing and only applies if a service was altered. Event ID 4624 records a successful account logon, an authentication event irrelevant to observing registry modifications in a sandbox. Note that 4657 auditing requires enabling the Audit Registry subkey/registry value auditing policy in the controlled environment before execution.
Community Comment Notes
All 100 recorded votes and every substantive comment select A, with 044f354 laying out each option's meaning: "A. Event ID 4657 Description: A registry value was modified". aqeel1506 adds that 4657 "provides information about what was changed, including the old and new values," reinforcing its usefulness for tracking registry changes. The comments consistently distinguish 4688 as process creation and 7040 as service change, matching the analysis above.
Official Reference
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the 46xx audit family by what each triggers: 4624 logon, 4688 process creation, 4657 object/registry attribute change — then match the verb in the question stem ('adds/modifies registry value') to the event that records attribute modification.
Frequently Asked Questions
Why doesn't Event ID 4688 show registry modifications?
Do I need special configuration for Event ID 4657 to appear?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Elb 👍 2 Answered A4657 A registry value was modified
-
aqeel1506 👍 1A. Event ID 4657 Explanation: Event ID 4657: This event is logged when there is a modification to an object’s attributes, including registry values. It provides information about what was changed, including the old and new values, making it useful for tracking changes to the registry. Other Event IDs: Event ID 4688: This event logs the creation of a new process, which would be useful for tracking the execution of the executable file itself but not for registry modifications. Event ID 7040: This event records changes to the service configuration, which is not directly related to registry modifications made by a program. Event ID 4624: This event logs a successful logon attempt, which is not related to registry modifications.
-
044f354 👍 1 Answered AA. Event ID 4657 Description: A registry value was modified B. Event ID 4688 Description: A new process has been created C. Event ID 7040 Description: A service was changed D. Event ID 4624 Description: An account was successfully logged on ----- If you agree: UPVOTE posts with a Yellow [Selected Answer:] banner to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.