Welcome to Event-o-Pedia
Ex: logon failure -"account disabled" -"LogType:Windows Event Log"
Found categories (1 - Events, 0 - Folders):
EventID 4794 - An attempt was made to set the Directory Services Restore Mode
Find more information about this event on ultimatewindowssecurity.com.
Operating System->Microsoft Windows->Built-in logs->Windows 2008 or higher->Security Log->Account Management->User Account Management->EventID 4794 - An attempt was made to set the Directory Services Restore Mode