Windows 10: Event 4672, Special Logon

Discus and support Event 4672, Special Logon in AntiVirus, Firewalls and System Security to solve the problem; Why would this event be shown in my logs. No one else has had access or been given access to my pc. I will attach the event records: Log Name:... Discussion in 'AntiVirus, Firewalls and System Security' started by Erfngel1, Dec 3, 2019.

  1. Erfngel1 Win User

    Event 4672, Special Logon


    Why would this event be shown in my logs. No one else has had access or been given access to my pc.


    I will attach the event records:


    Log Name: Security

    Source: Microsoft-Windows-Security-Auditing

    Date: 12/3/2019 3:55:00 AM

    Event ID: 4672

    Task Category: Special Logon

    Level: Information

    Keywords: Audit Success

    User: N/A

    Computer:

    Description:

    Special privileges assigned to new logon.



    Subject:

    Security ID: SYSTEM

    Account Name: SYSTEM

    Account Domain: NT AUTHORITY

    Logon ID: 0x3E7



    Privileges: SeAssignPrimaryTokenPrivilege

    SeTcbPrivilege

    SeSecurityPrivilege

    SeTakeOwnershipPrivilege

    SeLoadDriverPrivilege

    SeBackupPrivilege

    SeRestorePrivilege

    SeDebugPrivilege

    SeAuditPrivilege

    SeSystemEnvironmentPrivilege

    SeImpersonatePrivilege

    SeDelegateSessionUserImpersonatePrivilege

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

    <EventID>4672</EventID>

    <Version>0</Version>

    <Level>0</Level>

    <Task>12548</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8020000000000000</Keywords>

    <TimeCreated SystemTime="2019-12-03T11:55:00.280502200Z" />

    <EventRecordID>8680324</EventRecordID>

    <Correlation ActivityID="{1b47e864-a4f5-0005-76e8-471bf5a4d501}" />

    <Execution ProcessID="884" ThreadID="23764" />

    <Channel>Security</Channel>

    <Computer></Computer>

    <Security />

    </System>

    <EventData>

    <Data Name="SubjectUserSid">S-1-5-18</Data>

    <Data Name="SubjectUserName">SYSTEM</Data>

    <Data Name="SubjectDomainName">NT AUTHORITY</Data>

    <Data Name="SubjectLogonId">0x3e7</Data>

    <Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege

    SeTcbPrivilege

    SeSecurityPrivilege

    SeTakeOwnershipPrivilege

    SeLoadDriverPrivilege

    SeBackupPrivilege

    SeRestorePrivilege

    SeDebugPrivilege

    SeAuditPrivilege

    SeSystemEnvironmentPrivilege

    SeImpersonatePrivilege

    SeDelegateSessionUserImpersonatePrivilege</Data>

    </EventData>

    </Event>

    :)
     
    Erfngel1, Dec 3, 2019
    #1
  2. Amit_Sun Win User

    Events 4672 & 4624 Win 10 Freezes - special LOGON ?

    Hi,

    Thank you for writing to Microsoft Community Forums.

    1. Are you on a domain network?
    2. May I know the make and the model number of your system?

    The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
    4672(S): Special privileges assigned to new logon.

    The Windows error logs will be located at Event Viewer > Windows Logs > System.

    Please follow the step below and check if it works for you.

    Step: Improve Windows 10 Performance.

    Try some of the following suggestions to help
    make your Windows 10 PC run better
    . The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

    Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
    the OS will reverted back to previous version you upgraded from.

    If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

    Hope it helps.

    Amit Sunar

    Microsoft Community – Moderator
     
    Amit_Sun, Dec 3, 2019
    #2
  3. SPECIAL LOGON in Event Log

    Hi Emeline,

    Thank you for posting the query on Microsoft Community.

    • When you say special logon, what are you referring to?
    • What do you mean by private browser window?

    Refer the link below for more information about event logs or viewer:

    Event
    viewer-- What is going on in your computer


    Please get back to us with the required information to assist you further.
     
    Kalpana Shankarappa, Dec 3, 2019
    #3
  4. Event 4672, Special Logon

    SPECIAL LOGON in Event Log

    Could these SPECIAL LOGON events be from when I AM USING a 'Private browser window'??? Or is it really someone trying to hack in... ALSO in the Event Log it shows an 'Audit Success' immediately following... so does that mean ,y computer is still SAFE????
     
    Emeline419, Dec 3, 2019
    #4
Thema:

Event 4672, Special Logon

Loading...
  1. Event 4672, Special Logon - Similar Threads - Event 4672 Special

  2. Special Logon Events happening before I log in

    in Windows 10 Support
    Special Logon Events happening before I log in: I have been troubleshooting an issue on my laptop. In the process, I have noticed that when I reboot, there are "special logon" events in Event Viewer, taking place (under my account) before I actually log back in. Reading about these events, it seems they are normally under...
  3. Microsoft Windows Security Auditing Event 4624 Followed By Event 4672 Crashes Games

    in Windows 10 Gaming
    Microsoft Windows Security Auditing Event 4624 Followed By Event 4672 Crashes Games: I have recently been having an issue where I'll be playing Rainbow Six Seige and the game will close at random. When the game closes (when I'm in the middle of playing it) there is no crash report and no report in the Application section of Event Viewer. But, when I go to the...
  4. NT Authority/Special Logon, /special privalages =$User now system owner X5

    in Windows 10 Network and Sharing
    NT Authority/Special Logon, /special privalages =$User now system owner X5: $user x5 using Azure, Visual Studioi Cc+ PYTHON project INTERRFACED TDAMERITRADE MY BROKERAGE ACCOUNT!!!!! Storing projects live code using system 32 and system as project repository for GITHUB aNd happy hacker team. total disregard for the operating system intrfer in...
  5. Watch Apple Special Event on September 10, 2019

    in Windows 10 News
    Watch Apple Special Event on September 10, 2019: Cupertino calling. Join us for an Apple special event live from the Steve Jobs Theater in Cupertino on September 10 at 10 a.m. PDT. Apple is expected to announce three new iPhones: the iPhone 11, the iPhone 11 Pro, and the iPhone 11 Pro Max. Also possibly launch the Apple...
  6. What is event 4672?

    in AntiVirus, Firewalls and System Security
    What is event 4672?: I've experienced some real interesting and worrying issues with my pc. It has taken over my life effected me psychologically and I feel as if in a virtual prison. I got 1903. What is going on?...
  7. Event Viewer - Security: "Special Login?"

    in User Accounts and Family Safety
    Event Viewer - Security: "Special Login?": Hi Guys, I'm a newbie at posting so please be gentle *Smile What's the deal with these "special logins" in the Security Report within Win10 Event Viewer? Here's a screenshot.: [img] The entries are frequent and every minute or so. What's going on? THank you in advance....
  8. Event 4672 & 4624 & 5379 PC Freezing

    in Windows 10 BSOD Crashes and Debugging
    Event 4672 & 4624 & 5379 PC Freezing: I have had this for a while now but it seems to have gotten worse recently. My PC has been freezing (1-4 seconds every hour or so) and the only thing that I can tie in is these Events happening at the same time as the freeze all the time. Events 4672 (Special privileges...
  9. Events 4672 & 4624 Win 10 Freezes - special LOGON ?

    in AntiVirus, Firewalls and System Security
    Events 4672 & 4624 Win 10 Freezes - special LOGON ?: My window 10 machine continues to freeze for 5-30 seconds intermittently. [ATTACH] I am running with an boot drive on an M2 SSD, which seems to be a common thread of most people having this issue. I have already done the SFC scan, and the reset/validation of all...
  10. Logon event

    in Windows 10 BSOD Crashes and Debugging
    Logon event: Hello, can someone help me to get out what kind of event is above? I can't understand who or what trying to connect into 192.168.10.50 server. A logon was attempted using explicit credentials. Subject: Security ID: SYSTEM Account Name: PC-1074-050917$ Account Domain: test...