WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Special Logon

Special Logon

This category logs one and only one event. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4672	Special privileges assigned to new logon

Back to top

 

Upcoming Webinars Breaking Free from AD Tech Debt: Securing the Path to Modernization “3 Persistent Privileged Access Methods in Active Directory: How Attackers Stick the Landing with AdminSdHolder, SIDHistory, DCShado”

Additional Resources