title description ms.pagetype ms.prod ms.mktglfcycl ms.sitesec ms.localizationpriority author ms.date ms.reviewer manager ms.author ms.technology

4672(S): unique privileges assigned to new logon.

You are watching: Special privileges assigned to new logon


Subcategory: Audit one-of-a-kind Logon

Event Description:

This occasion generates for brand-new account logons if any kind of of the adhering to sensitive privileges room assigned come the new logon session:

SeTcbPrivilege - act as part of the operating system

SeBackupPrivilege - earlier up files and directories

SeCreateTokenPrivilege - develop a token object

SeDebugPrivilege - Debug programs

SeEnableDelegationPrivilege - allow computer and also user account to be trusted because that delegation

SeAuditPrivilege - Generate security audits

SeImpersonatePrivilege - Impersonate a client after authentication

SeLoadDriverPrivilege - Load and also unload device drivers

SeSecurityPrivilege - regulate auditing and security log

SeSystemEnvironmentPrivilege - modify firmware setting values

SeAssignPrimaryTokenPrivilege - change a process-level token

SeRestorePrivilege - reclaim files and also directories,

SeTakeOwnershipPrivilege - Take property of records or other objects

You generally will see plenty of of these events in the occasion log, because every logon of mechanism (Local System) account root cause this event.

Note because that recommendations, see defense Monitoring referrals for this event.

Event XML:

Required Server Roles: None.

Minimum OS Version: home windows Server 2008, home windows Vista.

Event Versions: 0.

Field Descriptions:


Security ID : SID of account to which one-of-a-kind privileges were assigned. Occasion Viewer immediately tries to solve SIDs and also show the account name. If the SID can not be resolved, friend will check out the source data in the event.

Note A security id (SID) is a unique value the variable length used to determine a trustee (security principal). Each account has a distinct SID that is approve by an authority, such as an active Directory domain controller, and also stored in a defense database. Every time a user logs on, the mechanism retrieves the SID for that user native the database and also places it in the access token for that user. The device uses the SID in the access token to identify the user in all succeeding interactions v Windows security. Once a SID has been supplied as the distinct identifier because that a user or group, that cannot ever before be supplied again to identify another user or group. For more information about SIDs, see security identifiers.

Account Name : the name of the account to which one-of-a-kind privileges to be assigned.

Account Domain : subject’s domain or computer name. Formats vary, and include the following:

Domain NETBIOS name example: CONTOSO

Lowercase complete domain name: contoso.local

Uppercase full domain name: CONTOSO.LOCAL

For neighborhood user accounts, this field will save on computer the name of the computer system or maker that this account belong to, because that example: “Win81”.

Privileges : the list of sensitive privileges, assigned come the brand-new logon. The complying with table has the perform of possible privileges because that this event:

Privilege NameUser Right group Policy NameDescription
SeAssignPrimaryTokenPrivilegeReplace a process-level tokenRequired to entrust the primary token that a process. V this privilege, the user have the right to initiate a procedure to replace the default token linked with a began subprocess.
SeAuditPrivilegeGenerate protection auditsWith this privilege, the user can add entries to the security log.
SeBackupPrivilegeBack up files and also directories- compelled to perform back-up operations. V this privilege, the user can bypass paper and directory, registry, and also other persistent object permissions because that the functions of backing up the system.This privilege causes the system to give all read access control to any kind of file, nevertheless of the access manage list (ACL) specified for the file. Any accessibility request various other than review is quiet evaluated through the ACL. The following accessibility rights space granted if this privilege is held:READ_CONTROLACCESS_SYSTEM_SECURITYFILE_GENERIC_READFILE_TRAVERSE
SeCreateTokenPrivilegeCreate a token objectAllows a procedure to develop a token i beg your pardon it have the right to then use to get accessibility to any kind of local resources once the process uses NtCreateToken() or various other token-creation APIs.When a procedure requires this privilege, us recommend making use of the LocalSystem account (which currently includes the privilege), rather than producing a different user account and assigning this privilege come it.
SeDebugPrivilegeDebug programsRequired to debug and readjust the memory of a procedure owned by an additional account.With this privilege, the user can affix a debugger come any process or come the kernel. We recommend the SeDebugPrivilege always be granted to Administrators, and also only come Administrators. Developer who room debugging their own applications carry out not require this user right. Developers who room debugging new system materials need this user right. This user right gives complete access to sensitive and crucial operating system components.
SeEnableDelegationPrivilegeEnable computer and user accounts to be trusted because that delegationRequired to note user and computer accounts together trusted for delegation.With this privilege, the user can set the Trusted because that Delegation setting on a user or computer object.The user or object that is granted this privilege must have write accessibility to the account control flags on the user or computer object. A server procedure running ~ above a computer (or under a user context) that is trusted because that delegation can accessibility resources on another computer utilizing the delegated credentials the a client, as lengthy as the account of the client does not have actually the Account can not be delegated account manage flag set.
SeImpersonatePrivilegeImpersonate a customer after authenticationWith this privilege, the user can impersonate various other accounts.
SeLoadDriverPrivilegeLoad and also unload maker driversRequired to fill or unloading a device driver.With this privilege, the user have the right to dynamically load and also unload machine drivers or other code in come kernel mode. This user appropriate does not apply to Plug and also Play machine drivers.
SeRestorePrivilegeRestore files and also directoriesRequired to perform restore operations. This privilege causes the mechanism to approve all write accessibility control to any kind of file, nevertheless of the ACL mentioned for the file. Any access request other than create is quiet evaluated v the ACL. Additionally, this privilege enables you to set any precious user or team SID as the owner the a file. The following accessibility rights are granted if this privilege is held:WRITE_DACWRITE_OWNERACCESS_SYSTEM_SECURITYFILE_GENERIC_WRITEFILE_ADD_FILEFILE_ADD_SUBDIRECTORYDELETEWith this privilege, the user have the right to bypass file, directory, registry, and other persistent objects permissions as soon as restoring backed up files and directories and also determines which users can set any valid security major as the owner of an object.
SeSecurityPrivilegeManage auditing and also security logRequired to execute a number of security-related functions, such together controlling and viewing audit events in security event log.With this privilege, the user deserve to specify object access auditing options for separation, personal, instance resources, such together files, energetic Directory objects, and registry keys.A user through this privilege can additionally view and also clear the defense log.
SeSystemEnvironmentPrivilegeModify firmware environment valuesRequired to modify the nonvolatile ram of systems that usage this kind of memory to store configuration information.
SeTakeOwnershipPrivilegeTake property of papers or various other objectsRequired to take property of things without gift granted discretionary access. This privilege permits the owner value to be set only come those values that the holder may legitimately assign together the owner of an object.With this privilege, the user have the right to take property of any securable object in the system, including energetic Directory objects, files and also folders, printers, it is registered keys, processes, and also threads.
SeTcbPrivilegeAct as part of the operation systemThis privilege identifies its holder as part of the trusted computer base.This user right enables a procedure to impersonate any type of user there is no authentication. The process can therefore gain access to the same regional resources together that user.

Security monitoring Recommendations

For 4672(S): one-of-a-kind privileges assigned to brand-new logon.

Important for this event, also see appendix A: defense monitoring recommendations for countless audit events.

See more: Download Montana Of 300 Wifin You Montana Of 300 Mp3 Download

Monitor for this occasion where “SubjectSecurity ID” is not one of these popular security principals: regional SYSTEM, NETWORK SERVICE, local SERVICE, and where “SubjectSecurity ID” is no an bureaucratic account that is intended to have actually the provided Privileges.

If you have actually a list of certain privileges which have to never be granted, or granted only to a couple of accounts (for example, SeDebugPrivilege), use this event to monitor because that those “Privileges.”