| Event Id | 4866 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A trusted forest information entry was removed. Subject: Security ID: <Security ID> Account Name: <Account Name> Account Domain: <Domain Name> Logon ID: <Logon ID> Trust Information: Forest Root:<Forest Root> Forest Root SID: <Forest Root SID> Operation ID: <Operation ID> Entry Type: <Entry Type> Flags:<Flags> Top Level Name:<Top Level Name> DNS Name:<DNS Name> NetBIOS Name:<NetBIOS Name> Domain SID: NULL SID |
| Event Information | Cause : This event is logged cross-forest trust relationships are deleted or modified. Resolution : This is an information event and no user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.