Windows Security Log Event ID 4622

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
System
 • Security System Extension
Type Success
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 4622
Event ID 4622

4622: A security package has been loaded by the Local Security Authority.

On this page

Security packages are yet another type of plug-in that extends security functionality in Windows.  MSDN defines a security package as "The software implementation of a security protocol. Security packages are contained in security support provider DLLs or security support provider/authentication package DLLs." From http://msdn2.microsoft.com/en-us/library/aa380130.aspx: Windows operating system supports authentication using security packages that function as both security support providers and as authentication packages. Security packages provide the logon process support services of a Windows authentication package and also provide authentication services to applications by implementing a set of functions that are mapped to the Security Support Provider Interface (SSPI). The security implication of event 4622 realistically, is low. Although a rogue package could cause great harm by stealing credentials at the time of logon, the effort required in developing and installing a rogue security package is significant.

Free Security Log Resources by Randy

Description Fields in 4622

  • Security Package Name: %1

Supercharger Enterprise


 

Examples of 4622

A security package has been loaded by the Local Security Authority.

Security Package Name: C:\Windows\system32\LSASRV.dll : Negotiate

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources