Special Logon
Enabled by default
Service: Microsoft Windows Security auditing
Log type: Security
A special logon indicates that a user or process with elevated or administrator privileges has logged onto the system. This log is recommended under HIPAA and PCI DSS for compliance and is recommended by the NSA Event Forwarding Guidance and JPCERT/CC.
Get-WinEvent -FilterHashTable @{LogName='Security';ID='4672'} -MaxEvents 1 | Format-List auditpol /get /subcategory:"Special Logon"
auditpol /set /subcategory:"Special Logon" /Success:Disable /Failure:Disable
auditpol /set /subcategory:"Special Logon" /Success:Enable /Failure:Enable
Compliance
HIPAA
Level: Recommended
PCI DSS
Level: Recommended
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf?agreement=true&time=1631643252599
NSA Event Forwarding
Level: Recommended
https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Events
To view this log in the Event Viewer, open the event viewer and navigate to the Windows Logs heading and then the Security Tab. From here, filter the log for the ID 4672.
To view this log in the command line with Get-WinEvent, open PowerShell as an administrator. From here, enter the command Get-WinEvent -FilterHashTable @{LogName='Security';ID='4672'} -MaxEvents 1 | Format-List
To view this log in the command line with wevtutil, open PowerShell or Command Prompt as an administrator. From here, enter the commandwevtutil qe Security "/q:*[System [(EventID=4672)]]"
