| Event Id | 5004 |
| Source | FCSAM |
| Description | The Microsoft Forefront Client Security Real-Time Protection agent configuration has changed. |
| Event Information | Cause : This event is logged when the Microsoft Forefront Client Security Real-Time Protection agent configuration has changed. This audit record includes the agent and the configuration element that have been changed. This event commonly occurs due to configuration changes by an administrator or user. This could indicate that malware has caused a configuration change. Resolution : Verify that the configuration change was applied intentionally. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.