Windows 10: Windows 11 Missing Security Log Event IDs 4802 and 4803? This a bug, feature, or maybe...

Windows 11 OS install clean, about 2 months ago. Fully updated as of this posting. This issue did not occur on Windows 10 or previous versions of Windows on same hardware. This is not a hardware issue. This issue has now happened on multiple instances of Windows 11 either upgraded from Windows 10 or new installation of Windows 11.Providing the correct AD or local security policy is set, the family of 4800 Event IDs should be published to the security event log. This includes 4800 lock workstation, 4801 unlock workstation, and 4802 invoke screen saver and 4803 dismiss screen saver.

:)

 

Windows 10 - Manually invoked Screen Saver and Events 4802, 4803

Hello!

I am working on scheduling a task based on event 4803, but I have come to the understanding that it is only created when the Screen Saver is invoked by timeout rather than manually running a .scr file. Is this by design? Is there a way to manually invoke
the screensaver and have it create the 4803 event when it is dismissed?

Thanks,

Mike

 

Event ID 11 Prio.dll

Event ID: 11 is normally a Warning not an Error as illustrated below;



Log Name: System

Source: Microsoft-Windows-Wininit

Date: 19/06/2014 11:04:28

Event ID: 11

Level: Warning

Description:

Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.



It is a caution to the user to check that it is not an uninvited visitor.



prio.dll is most likely a component of O & K Print Watch. Have you installed this software?

https://www.prnwatch.com/

 

Windows 10 workstation Security log filling with Event ID 4703

My Windows 10 workstation's Security Event Log is filled with informational Event ID 4703 (like 20/second).

It's an Audit Success on Authorization Policy Change category.

Pretty much all are about the javaw.exe process & SeSecurityPrivilege. But also a few of them list svchost.exe as the process & a whole list of privileges.

I can't find anything on the Net about event 4703.

Sometimes it lists the privilege as Disabled (as below), and some are Enabled. Back & forth, multiple events per second.

Does anyone have any idea what/why this is, or anyone else experiencing it?

Here are the details of the event (edited for privacy)...

Task Category: Authorization Policy Change

Level: Information

Keywords: Audit Success

User: N/A

Computer: xxxxx.yyyy.com

Description:

A user right was adjusted.

Subject:

Security ID: SYSTEM

Account Name: XXXXXX

Account Domain: YYYYYYYY

Logon ID: 0x3E7

Target Account:

Security ID: SYSTEM

Account Name: XXXXXXX

Account Domain: YYYYYYYYY

Logon ID: 0x3E7

Process Information:

Process ID: 0xb24

Process Name: C:\Windows\SysWOW64\ContegoSPOP\jre1.7.0_65\bin\javaw.exe

Enabled Privileges:

-

Disabled Privileges:

SeSecurityPrivilege