Windows Security Log Event ID 4622

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
 • Security System Extension
Type Success
Corresponding events
in Windows 2003
and before

4622: A security package has been loaded by the Local Security Authority.

On this page

Security packages are yet another type of plug-in that extends security functionality in Windows.  MSDN defines a security package as "The software implementation of a security protocol. Security packages are contained in security support provider DLLs or security support provider/authentication package DLLs." From Windows operating system supports authentication using security packages that function as both security support providers and as authentication packages. Security packages provide the logon process support services of a Windows authentication package and also provide authentication services to applications by implementing a set of functions that are mapped to the Security Support Provider Interface (SSPI). The security implication of event 4622 realistically, is low. Although a rogue package could cause great harm by stealing credentials at the time of logon, the effort required in developing and installing a rogue security package is significant.

Free Security Log Resources by Randy

Description Fields in 4622

  • Security Package Name: %1

Setup PowerShell Audit Log Forwarding in 4 Minutes


Examples of 4622

A security package has been loaded by the Local Security Authority.

Security Package Name: C:\Windows\system32\LSASRV.dll : Negotiate

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources