WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Special Logon

Special Logon

This category logs one and only one event. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4672	Special privileges assigned to new logon

Back to top

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources