Tools · Windows security and Event Logs · 10 / 27
Event ID 4672: tracking administrator logons with special privileges
Use 4672 to see when accounts with administrative privileges log on, link it to 4624 by Logon ID, and build a list of who acts as an admin where.
What 4672 means
4672 “Special privileges assigned to new logon” fires right after a 4624 when the new session holds sensitive privileges such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, or SeTakeOwnershipPrivilege. In practice it marks administrator-equivalent logons.
The Logon ID in 4672 matches the 4624 for the same session, so you can join them to get the logon type and source address.
Filtering the noise
SYSTEM, LOCAL SERVICE, NETWORK SERVICE, and computer accounts generate many 4672 events. Exclude them, and what remains is the list of human and service accounts acting with admin rights on that machine.
Join with 4624 to keep only interactive and RDP logons (types 2 and 10) if you want to see where admin credentials were exposed.
Lab: who acted as admin today
On a lab server, log on as a domain admin over RDP and as a normal user at the console. Query 4672 and 4624 for today, join on Logon ID, exclude machine and system accounts, and print user, logon type, and source.
In a real environment, run this on servers and workstations and compare with who is supposed to administer them. A domain admin logging on interactively to a workstation is a tiering violation.
$since=(Get-Date).Date
$priv = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=$since} | % { $_.Properties[3].Value }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$since} |
Where-Object { $priv -contains $_.Properties[7].Value -and $_.Properties[5].Value -notmatch '\$|^SYSTEM#x27; } |
Select TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='Type';e={$_.Properties[8].Value}}, @{n='From';e={$_.Properties[18].Value}}Using the result
Turn the output into a matrix of admin accounts and the machines they log on to. That matrix shows where credentials are exposed and supports a tiering model where domain admins only log on to domain controllers and admin workstations.
Alert on 4672 for accounts that should never hold admin rights, and for admin accounts logging on to machines outside their tier.
Diagram
An expected and an unexpected admin logon
Same event ID, different meaning.
Account. srv-admin-jdoe
Machine. File server, from admin jump host.
Type. 3 or 10 from the jump host.
Account. Domain admin
Machine. A user workstation.
Type. 2 or 10: credentials now in workstation memory.
Check yourself
1. What does 4672 indicate?
2. Which field joins 4672 to its 4624?
3. Which finding is a tiering violation?