Unauthorized Configuration Change Detected – Fix in 3 Minutes

You're seeing 'Unauthorized Configuration Change Detected' and it's annoying. Let's fix it right now.

Fix: Stop the Warning

This warning comes from Windows Security Auditing. It's a feature that logs when someone changes security settings. The real fix is to change how the system handles this alert.

1. Press Windows key + R. This opens the Run box.
2. Type secpol.msc and press Enter. You'll see Local Security Policy window.
3. Click Local Policies on the left side, then Audit Policy.
4. Look for Audit privilege use in the list. Double-click it.
5. Check the boxes: Success and Failure should both be unchecked. If they're checked, uncheck them.
6. Click Apply, then OK.
7. Close the Local Security Policy window.

After this: The warning should stop showing up. But wait – you're not done yet. You should check who caused it first.

Who Made the Change? (Check This First)

You need to look at the Windows Event Log. Here's how:

1. Press Windows key + R, type eventvwr.msc, press Enter.
2. In Event Viewer, go to Windows Logs > Security.
3. On the right side, click Filter Current Log.
4. In the Event IDs box, type 4719, then click OK.
5. You'll see a list of events. Double-click the newest one.
6. Look for Subject section. Under Account Name, you'll see the username of the account that made the change.
7. Also check Audit Policy Change section – it shows what setting changed. Common ones: SeSecurityPrivilege or SeTakeOwnershipPrivilege.

If the account name says SYSTEM, it's usually a Windows update or antivirus software making changes. If it's a local user name like John or Admin, someone logged into your computer and changed security settings.

Why This Worked

The warning pops up because Windows audits every time someone changes security settings. By turning off 'Audit privilege use', you stop the system from recording those changes. The warning doesn't appear anymore.

But here's the thing – this doesn't fix the root cause. The change still happens. You're just hiding the notification. That's why step two is important: find out who made the change.

Less Common Variations

Sometimes the error shows up differently. Here's what else to check:

• Event ID 4670 – Appears when permissions on a file or folder change. You'll see it in the same Security log. Fix: Check which program changed permissions.
• Event ID 4732 – Shows when someone adds a user to a security group. Common with antivirus updates or software installs. Fix: Check the account that added the user.
• Group Policy changes – If you manage a company network, this warning might come from a domain controller pushing new policies. You can't stop it – it's normal.

Prevention Tips

To stop this from happening again:

1. Check your antivirus – Some antivirus programs (like Bitdefender or Norton) change security settings during updates. Go into the antivirus settings and turn off 'Security policy management' or similar options.
2. Limit admin accounts – Only you should have admin rights on your PC. Remove admin rights from other users. Go to Settings > Accounts > Family & other users. Click the user, then 'Change account type' and pick 'Standard User'.
3. Update Windows – Microsoft fixed some false warning bugs in Windows 10 Version 22H2 and Windows 11 Version 23H2. Check for updates.
4. Run a malware scan – If you don't recognize the account that made the change, run Windows Defender Full Scan. Malware sometimes changes security settings to hide itself.

Tip: If you're still seeing the warning after all this, try a System Restore to a point before the change. Search 'Create a restore point' in Start, click System Restore, pick a date before the warning started.

That's it. You've stopped the warning, found who did it, and set up protection. You can now use your computer without that annoying popup.