Windows 10: Event 4672, Special Logon

Why would this event be shown in my logs. No one else has had access or been given access to my pc.


I will attach the event records:


Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 12/3/2019 3:55:00 AM

Event ID: 4672

Task Category: Special Logon

Level: Information

Keywords: Audit Success

User: N/A

Computer:

Description:

Special privileges assigned to new logon.



Subject:

Security ID: SYSTEM

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3E7



Privileges: SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

SeDelegateSessionUserImpersonatePrivilege

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

<EventID>4672</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>12548</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2019-12-03T11:55:00.280502200Z" />

<EventRecordID>8680324</EventRecordID>

<Correlation ActivityID="{1b47e864-a4f5-0005-76e8-471bf5a4d501}" />

<Execution ProcessID="884" ThreadID="23764" />

<Channel>Security</Channel>

<Computer></Computer>

<Security />

</System>

<EventData>

<Data Name="SubjectUserSid">S-1-5-18</Data>

<Data Name="SubjectUserName">SYSTEM</Data>

<Data Name="SubjectDomainName">NT AUTHORITY</Data>

<Data Name="SubjectLogonId">0x3e7</Data>

<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

SeDelegateSessionUserImpersonatePrivilege</Data>

</EventData>

</Event>

:)

 

Events 4672 & 4624 Win 10 Freezes - special LOGON ?

Hi,

Thank you for writing to Microsoft Community Forums.

1. Are you on a domain network?
   
2. May I know the make and the model number of your system?
   

The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
4672(S): Special privileges assigned to new logon.

The Windows error logs will be located at Event Viewer > Windows Logs > System.

Please follow the step below and check if it works for you.

Step: Improve Windows 10 Performance.

Try some of the following suggestions to help
make your Windows 10 PC run better. The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
the OS will reverted back to previous version you upgraded from.

If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

Hope it helps.

Amit Sunar

Microsoft Community – Moderator

 

SPECIAL LOGON in Event Log

Hi Emeline,

Thank you for posting the query on Microsoft Community.

• When you say special logon, what are you referring to?
• What do you mean by private browser window?

Refer the link below for more information about event logs or viewer:

Event
viewer-- What is going on in your computer

Please get back to us with the required information to assist you further.

 

SPECIAL LOGON in Event Log

Could these SPECIAL LOGON events be from when I AM USING a 'Private browser window'??? Or is it really someone trying to hack in... ALSO in the Event Log it shows an 'Audit Success' immediately following... so does that mean ,y computer is still SAFE????