// REFERENCE
4672 — Special privileges assigned to new logon
Log: Security
Medium risk
A logon was granted sensitive privileges (marking an administrative logon). Paired with 4624 it flags every time an admin enters a system; useful to monitor privileged-account usage.
Related tools
Work with this in:
Related
4673
4673 — Sensitive privilege use 4688
4688 — A new process was created 4689
4689 — A process has exited
4673 — Sensitive privilege use 4688
4688 — A new process was created 4689
4689 — A process has exited
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.