Windows Security Log Event ID 4626

Operating Systems Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Logon/Logoff
 • Logon
Type Success
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 4626
Ask a question about this event

4626: User/Device claims information

On this page

Free Security Log Resources by Randy

Supercharger Free Edition


Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Examples of 4626

User / Device claims information.

Subject:
    Security ID:     %1
    Account Name:    %2
    Account Domain:  %3
    Logon ID:        %4

Logon Type:          %9

New Logon:
    Security ID:     %5
    Account Name:    %6
    Account Domain:  %7
    Logon ID:        %8

Event in sequence:   %10 of %11

User Claims:         %12

Device Claims:       %13

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

This event is generated when the Audit User/Device claims subcategory is configured and the user’s logon token contains user/device claims information. The Logon ID field can be used to correlate this event with the corresponding user logon event as well as to any other security audit events generated during this logon session.

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources