Windows Security Log Event ID 622
| Operating Systems |
Windows 2003 and XP
|
|
Category | Policy Change |
|
Type
|
Success
|
Corresponding events
in Windows
2008
and Vista |
4718
|
622: System Security Access Removed
On this page
A logon right was revoked from the Removed From user or group. See event 621 for a full explanation.
Note: This event and 621 log changes to strictly logon rights such as "Access this computer from the network" or "Logon as a service" - not to other rights such as "Change the system time" or "Take ownership of files and other objects". See events 608 and 609.
Logon Rights
| System name |
Description |
| SeNetworkLogonRight |
Access this computer from the network |
| SeRemoteInteractiveLogonRight |
Allow logon through Terminal Services |
| SeDenyNetworkLogonRight |
Deny access to this computer from the network |
| SeDenyBatchLogonRight |
Deny logon as a batch job |
| SeDenyServiceLogonRight |
Deny logon as a service |
| SeDenyInteractiveLogonRight |
Deny logon locally |
| SeDenyRemoteInteractiveLogonRight |
Deny logon through Terminal Services |
| SeBatchLogonRight |
Log on as a batch job |
| SeServiceLogonRight |
Log on as a service |
| SeInteractiveLogonRight |
Log on locally |
Free Security Log Resources by Randy
- Access Removed: %4
- Account Modified: %5
- Removed By:
- User Name: %1
- Domain: %2
- Logon ID: %3
Setup PowerShell Audit Log Forwarding in 4 Minutes