ZEKASTRA

SecurityLogon and session

4672 · Special privileges assigned to new logon

Generated when a new logon session receives sensitive privileges such as SeDebugPrivilege, SeBackupPrivilege or SeTcbPrivilege. Every SYSTEM logon also triggers it.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

Join SubjectLogonId to the 4624 recorded at the same moment to identify administrative-equivalent logons. Focus on accounts other than SYSTEM, LOCAL SERVICE and NETWORK SERVICE.

03Caveats

Recorded only when the "Audit Special Logon" audit subcategory is enabled. Retention depends on log size and overwrite settings.

05Sources

  1. Microsoft Learn — 4672(S) Special privileges assigned to new logon checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.