Windows EventInformation
Windows Event ID 4976 – Microsoft-Windows-Security-Auditing: Special Logon
Event ID 4976 records when a user account is granted special privileges during logon, typically for service accounts or administrative access requiring elevated permissions.
