Event ID 4672 Special logon Expand / Collapse
Author
Message
Posted 8/21/2015 2:02:09 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/21/2015 1:54:01 PM
Posts: 1, Visits: 0
I have server where I am see ton of 4672, 4769, 4634 in the security logs of event viewer. I believe the first event is 4672 which I pasted below..has anyone every seen this issue before?

ubject:
Security ID: SYSTEM
Account Name: server01$
Account Domain: test
Logon ID: 0x376d7d03c

Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
Post #4828
Posted 8/23/2015 8:16:19 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
I'm not sure what the issue is? 4672 will be generated every time there is a logon event from an administrator level user.
Post #4838
Posted 1/3/2019 9:05:28 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/3/2019 9:03:21 PM
Posts: 1, Visits: 1
[font=Arial][size=6]What if you weren't home when it shows that someone was logged onto your computer?[/size][/font]
Post #8531
Posted 1/5/2019 11:00:34 AM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Is that what is happening? An unexpected administrative login could be anomalous depending on the scenario.
Post #8536
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:14am