Windows Security Log Event ID 622

Operating Systems Windows 2003 and XP
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista		 4718  
Discussions on Event ID 622
Ask a question about this event

622: System Security Access Removed

On this page

A logon right was revoked from the Removed From user or group. See event 621 for a full explanation.

Note: This event and 621 log changes to strictly logon rights such as "Access this computer from the network" or "Logon as a service" - not to other rights such as "Change the system time" or "Take ownership of files and other objects". See events 608 and 609.

Logon Rights

System name Description
SeNetworkLogonRight Access this computer from the network
SeRemoteInteractiveLogonRight Allow logon through Terminal Services
SeDenyNetworkLogonRight Deny access to this computer from the network
SeDenyBatchLogonRight Deny logon as a batch job
SeDenyServiceLogonRight Deny logon as a service
SeDenyInteractiveLogonRight Deny logon locally
SeDenyRemoteInteractiveLogonRight Deny logon through Terminal Services
SeBatchLogonRight Log on as a batch job
SeServiceLogonRight Log on as a service
SeInteractiveLogonRight Log on locally

Free Security Log Resources by Randy

Description Fields in 622

  • Access Removed: %4
  • Account Modified: %5
  • Removed By:
  • User Name: %1
  • Domain:  %2
  • Logon ID: %3

Supercharger Free Edition

 

Examples of 622

System Security Access Removed:
Access Removed: SeRemoteInteractiveLogonRight
Account Modified: BUILTIN\Administrators
Removed By:
User Name: W3DC$
Domain: ELM
Logon ID: (0x0,0x3E7)

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



Mini-Seminars Covering Event ID 622
Discussions on Event ID 622
Ask a question about this event

 

Upcoming Webinars
Additional Resources