622: System Security Access Removed
On this page
A logon right was revoked from the Removed From user or group. See event 621 for a full explanation. Note: This event and 621 log changes to strictly logon rights such as "Access this computer from the network" or "Logon as a service" - not to other rights such as "Change the system time" or "Take ownership of files and other objects". See events 608 and 609.
System Security Access Removed: Access Removed: SeRemoteInteractiveLogonRight Account Modified: BUILTIN\Administrators Removed By: User Name: W3DC$ Domain: ELM Logon ID: (0x0,0x3E7)
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection
Go To Event ID:
Security Log Quick Reference Chart Download now!