Windows Security Log Event ID 608

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista
4704  
Discussions on Event ID 608
Ask a question about this event

608: User Right Assigned

On this page

This event documents a change to user right assignments on this computer. Rights, like most other security settings, are defined in group policy objects and applied by the computer. Therefore this event will normally show the Assigned By user as the system itself. To determine who actually made the rights assignment change you must search the domain controllers' security logs for changes to gpContainer objects (logged by Directory Service auditing). Logon ID allows you to link this event to the prior event 528 or 540 logon event of the user who performed this action.

Assigned To identifies the user or group who was assigned the right. Prefixed by domain name.

This event documents the system name for each user right as opposed to the more familiar description. Click here for a cross reference.

Note: This event and 609 do not log changes to logon rights such as "Access this computer from the network" or "Logon as a service". See events 621 and 622

User Rights

User Right
Description
SeTcbPrivilege
Act as part of the operating system
SeMachineAccountPrivilege
Add workstations to domain
SeIncreaseQuotaPrivilege
Adjust memory quotas for a process
SeBackupPrivilege
Back up files and directories
SeChangeNotifyPrivilege
Bypass traverse checking
SeSystemtimePrivilege
Change the system time
SeCreatePagefilePrivilege
Create a pagefile
SeCreateTokenPrivilege
Create a token object
SeCreatePermanentPrivilege
Create permanent shared objects
SeDebugPrivilege
Debug programs
SeEnableDelegationPrivilege
Enable computer and user accounts to be trusted for delegation
SeRemoteShutdownPrivilege
Force shutdown from a remote system
SeAuditPrivilege
Generate security audits
SeIncreaseBasePriorityPrivilege
Increase scheduling priority
SeLoadDriverPrivilege
Load and unload device drivers
SeLockMemoryPrivilege
Lock pages in memory
SeSecurityPrivilege
Manage auditing and security log
SeSystemEnvironmentPrivilege
Modify firmware environment values
SeManageVolumePrivilege
Perform volume maintenance tasks
SeProfileSingleProcessPrivilege
Profile single process
SeSystemProfilePrivilege
Profile system performance
SeUndockPrivilege
Remove computer from docking station
SeAssignPrimaryTokenPrivilege
Replace a process level token
SeRestorePrivilege
Restore files and directories
SeShutdownPrivilege
Shut down the system
SeSyncAgentPrivilege
Synchronize directory service data
SeTakeOwnershipPrivilege
Take ownership of files or other objects

Free Security Log Resources by Randy

Description Fields in 608

  • User Right: (system name of privilege)
  • Assigned To:
  • Assigned By 
  • User Name:
  • Domain:
  • Logon ID:

Supercharger Free Edition

 

Examples of 608

User Right Assigned:
User Right: SeUndockPrivilege
Assigned To: MTG\rsmith
Assigned By:
User Name: MTG1$
Domain: MTG
Logon ID: (0x0,0x3E7)

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources