Event ID 4672: special privileges assigned to new logon
Event 4672 is written right after a logon (4624) when the new session holds powerful rights – debug programs, take ownership of files, act as part of the operating system. In practice it marks administrator-level logons. Most come from Windows itself; the ones from real people are the logons to watch.
- What it is: the logon got sensitive privileges (e.g.
SeDebugPrivilege,SeTakeOwnershipPrivilege). - Matches a 4624 through the Logon ID, usually in the same second.
- Most entries: SYSTEM, LOCAL SERVICE, NETWORK SERVICE and computer accounts – ignore them.
- Worth watching: real user accounts with admin rights, especially from a new place or at an unusual time.
1. The privileges in the event
| Privilege | Allows |
|---|---|
SeDebugPrivilege | Reading other programs' memory – also how passwords are stolen from lsass.exe. |
SeTakeOwnershipPrivilege | Taking any file or object. |
SeBackupPrivilege / SeRestorePrivilege | Reading / writing any file regardless of permissions. |
SeLoadDriverPrivilege | Loading drivers. |
SeImpersonatePrivilege | Acting as another user after they authenticated (services). |
SeTcbPrivilege | Acting as part of the operating system. |
It comes from the audit subcategory Special Logon, on by default.
2. PowerShell: real admin logons
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$skip = 'SYSTEM','LOCAL SERVICE','NETWORK SERVICE','DWM-*','UMFD-*'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
ForEach-Object { $f = Get-EventFields $_
if ($f.SubjectUserName -notlike '*$' -and -not ($skip | Where-Object { $f.SubjectUserName -like $_ })) {
[pscustomobject]@{ Time = $_.TimeCreated; User = "$($f.SubjectDomainName)\$($f.SubjectUserName)"; LogonId = $f.SubjectLogonId } } } |
Group-Object User | Sort-Object Count -Descending | Select-Object Count, NameTo see where an admin logon came from, look up the 4624 with the same Logon ID (TargetLogonId there) and read its source address and logon type.
3. What to look for
- An account you did not expect to be an administrator – check the Administrators group (4732 shows who was added).
- Admin logons by Remote Desktop from the internet – the 4624 behind it has logon type 10 and an outside address.
- Admin logons at night or at the weekend from accounts that normally work office hours.
- Service accounts logging on interactively: they should only run services.
4. Let Coinetic watch it for you
Coinetic works where most of these logons start – on the way in:
- Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
- Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
- Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Why are there thousands of 4672 from SYSTEM?
Windows services log on with SYSTEM and similar accounts, which always hold these privileges. Filter them out and look at real user accounts.
Does 4672 mean someone used the privilege?
No, only that the session received it. Use of sensitive privileges is a different event (4673), which is off by default for good reason - it can flood the log.
Is a 4672 for my own admin account a problem?
No, it is expected every time you log on with administrator rights. It becomes interesting when the time, the place or the account is unusual.