Skip to main content
AD Academy
Back to all events
4672Security (DC)Security & attacksWARNLast updated:

Special privileges assigned to new logon

What it means

The logon received sensitive privileges (SeDebug, SeBackup, SeTakeOwnership). Almost always accompanies an admin logon.

First steps

  1. 1Use it to count admin logons per server and hour.
  2. 2An admin logon on a normal workstation breaks the tier model.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.